A device does not place a bare IP packet directly onto an Ethernet link. It wraps that packet in an Ethernet frame so switches and network interfaces know where the local transmission should go and whether it arrived without a detected bit error.

Definition: an Ethernet frame is the link-layer unit of data carried across an Ethernet network. Plain English: it is a local delivery envelope. The destination and source MAC addresses are written on the outside, while the higher-layer data rides inside as the payload.

This technician lesson builds on OSNTC.005: DHCP Basics, OSNTC.006: DNS Basics, and OSNTC.007: MAC Address Basics.

The five fields technicians should recognize

A common untagged Ethernet II frame, counted from the destination address through the FCS, contains these fields:

• Destination MAC — 6 bytes: the intended local recipient, a multicast group, or the broadcast address.
• Source MAC — 6 bytes: the interface that transmitted the frame onto this link.
• EtherType — 2 bytes: identifies the payload protocol. Common examples include 0x0800 for IPv4, 0x86DD for IPv6, and 0x0806 for ARP.
• Payload and padding — 46 to 1500 bytes: carries the higher-layer data; padding fills a short payload to the minimum size.
• Frame Check Sequence (FCS) — 4 bytes: carries a CRC value used to detect corruption.

Destination MAC | Source MAC | EtherType | Payload + Pad | FCS
     6 bytes     |   6 bytes  |  2 bytes  | 46–1500 B    | 4 B

This simplified field strip is an Ethernet II frame. The preamble and Start Frame Delimiter help the receiver synchronize and identify the beginning on the medium, but they are normally excluded from the familiar 64-byte minimum and 1518-byte maximum frame sizes.

Video 1: inspect an Ethernet frame field by field

Core Networking Classes compares Ethernet II and IEEE 802.3 framing. For this lesson, focus first on the destination, source, type or length, payload, and FCS fields.

Why the frame has two addresses

A switch learns from the source MAC address. It records the source address and the port where that frame arrived. It then examines the destination MAC to decide where to forward the frame.

If the destination is already in the switch MAC table, the switch can forward toward the learned port. If the destination is unknown, the switch floods the frame out other eligible ports in the same VLAN. A broadcast is also flooded within that broadcast domain.

Simple example: a scoreboard computer sends an Ethernet frame to a local display controller. The source field names the computer interface; the destination field names the display interface. The score update itself is inside the payload.

Frame versus packet

A frame is used for delivery across one Ethernet link or Layer 2 domain. A packet is a Layer 3 unit, such as an IPv4 packet, carried inside the frame payload. When a router forwards the packet onto a different Ethernet link, it removes the incoming frame and builds a new frame with MAC addresses appropriate for the next link.

That is why a remote server’s MAC address is normally absent from a workstation’s local frame. For an off-subnet destination, the workstation sends the local Ethernet frame to its default gateway’s MAC address while keeping the remote IP address in the encapsulated IP packet.

Video 2: learn the seven on-wire parts

Sunny Classroom includes the preamble and Start Frame Delimiter in its on-wire walkthrough. Compare that full transmission view with the five-field frame strip above.

Minimum size, padding, and FCS

An untagged Ethernet frame is normally at least 64 bytes from destination MAC through FCS. If the higher-layer payload is shorter than 46 bytes, padding fills the difference. The usual maximum is 1518 bytes for the same untagged count: 14 bytes of header, 1500 bytes of payload, and 4 bytes of FCS.

The sender calculates a CRC and places it in the FCS. The receiver performs its own calculation. A mismatch indicates a damaged frame, which is normally discarded. FCS detects errors; it does not repair the frame or request retransmission by itself. Higher-layer protocols may provide recovery.

Troubleshooting note: CRC or FCS error counters can point toward damaged cabling, bad optics or transceivers, electrical interference, duplex-era issues, or faulty interfaces. The counter identifies a symptom. It does not prove one specific cause.

Video 3: follow data across Ethernet

Wendell Odom connects MAC addresses, switch decisions, and Ethernet delivery. Follow the frame from the sender to the switch and then toward the local destination.

Where a VLAN tag fits

On an IEEE 802.1Q trunk, a four-byte VLAN tag is inserted after the source MAC address and before the original EtherType field. The tag lets devices associate the frame with a VLAN across the trunk. This expands the commonly counted maximum frame from 1518 to 1522 bytes, and the transmitting device calculates the FCS for the tagged frame. Cisco’s 802.1Q guide documents the tag placement and size.

An access port normally sends and receives ordinary untagged traffic for its assigned VLAN from an endpoint. A trunk can carry multiple VLANs between network devices. Always verify the actual port configuration rather than deciding from cable type alone.

A practical technician workflow

• Identify the interface: record the expected device MAC address.
• Check the switch table: verify which port learned that source MAC and in which VLAN.
• Confirm the destination: decide whether the frame should target a local host, broadcast, multicast group, or default gateway.
• Review counters: look for CRC/FCS errors, runts, giants, drops, and link changes using approved tools.
• Capture when authorized: in Wireshark, expand the Ethernet II header to see source, destination, and EtherType. Many host captures do not include the wire FCS because hardware may remove or validate it before the capture reaches software.

Practice and answers

1. Which MAC address does a switch learn from? Answer: the source MAC address.

2. What does EtherType 0x0800 identify? Answer: an IPv4 payload.

3. Why is padding added? Answer: to bring a short payload up to the Ethernet minimum.

4. Does FCS correct a damaged frame? Answer: no; it supports error detection.

5. What changes when a router forwards an IP packet onto another Ethernet link? Answer: the router builds a new Ethernet frame with next-link MAC addresses.

6. Where is an 802.1Q tag inserted? Answer: after the source MAC and before the original EtherType field.

Key takeaway

An Ethernet frame carries a local source, a local destination, a payload type, the payload itself, and an error-detection value. Read those fields in order, then connect them to the switch port, VLAN, and next-hop decision.