Ethernet II frames // IEEE 802.3

The link-layer frame that carries IP, ARP and VLAN tags across a LAN. Ethernet II has no length field: the EtherType says what follows. A 32-bit CRC at the end protects the entire frame, even though most packet captures throw it away.

IEEE 802.3 · Ethernet IANA EtherTypes IEEE 802.1Q · VLAN CRC-32 FCS 64–1518 B frame link layer

layer link header 14 B (+4 B VLAN) payload 46–1500 B FCS 4 B · usually stripped

layout
EtherTypes
VLAN
encode
decode
notes

01Frame layout

MAC header · 14 bytes

An Ethernet II frame begins with a 6-byte destination MAC address, a 6-byte source MAC address, and a 2-byte EtherType. The payload follows; the FCS is the last four bytes. The 8-byte preamble/SFD and the interpacket gap live at the physical layer and are not part of the captured frame.

64 bytes from destination MAC through FCS

An Ethernet frame is 64–1518 bytes without VLAN tagging, or up to 1522 bytes with a single 802.1Q tag. The minimum payload is 46 bytes untagged and 42 bytes tagged; short payloads are padded. Jumbo frames exceed 1500 bytes but are not part of the base standard. Frames shorter than 64 bytes are runts.

02EtherType

≥ 0x0600 means type; ≤ 1500 means length

The 16-bit field after the source MAC is an EtherType in Ethernet II. Values from 0x0600 (1536) upward identify the payload protocol. Values up to 1500 are an IEEE 802.3 length field instead; 1501–1535 are reserved. A VLAN tag temporarily occupies this position with TPID 0x8100.

EtherType	Payload	Reference	Notes
`0x0800`	IPv4	RFC 894	Classic IPv4 over Ethernet II.
`0x0806`	ARP	RFC 826	IPv4 address resolution over Ethernet.
`0x8035`	RARP	RFC 903	Reverse ARP; obsolete in practice.
`0x8100`	802.1Q VLAN	IEEE 802.1Q	TPID followed by a 16-bit TCI and the inner EtherType.
`0x86DD`	IPv6	RFC 2464	IPv6 over Ethernet.
`0x8847`	MPLS	RFC 3032	MPLS unicast.
`0x8848`	MPLS multicast	RFC 3032	MPLS multicast.
`0x8863`	PPPoE Discovery	RFC 2516	PPP over Ethernet discovery stage.
`0x8864`	PPPoE Session	RFC 2516	PPP over Ethernet session stage.
`0x888E`	EAPOL	IEEE 802.1X	Port-based network access control.
`0x88A8`	802.1ad QinQ	IEEE 802.1ad	Outer service VLAN tag; another tag usually follows.
`0x88CC`	LLDP	IEEE 802.1AB	Link Layer Discovery Protocol.
`0x88F7`	PTP	IEEE 1588	Precision Time Protocol over Ethernet.
`0x8906`	FCoE	INCITS T11	Fibre Channel over Ethernet.
`0x8915`	RoCE	InfiniBand TA	RDMA over Converged Ethernet.

03802.1Q VLAN tags

4 bytes between source MAC and EtherType

A VLAN tag inserts a 2-byte TPID (0x8100 for 802.1Q, 0x88A8 for 802.1ad) followed by a 16-bit TCI. The TCI carries a 3-bit priority, a drop-eligibility bit and a 12-bit VLAN identifier.

PCP traffic classes

PCP	Traffic class	Typical use
`0`	Best effort	Default class; no priority guarantee.
`1`	Background	Bulk or non-latency-sensitive traffic.
`2`	Excellent effort	Best-effort traffic with a higher queue weight.
`3`	Critical applications	Traffic with a bounded latency requirement.
`4`	Video	Video with latency below 100 ms.
`5`	Voice	Latency below 10 ms; usually strict priority.
`6`	Internetwork control	Routing and other network-control protocols.
`7`	Network control	Highest priority; reserve for critical control traffic.

VID ranges

VID	Meaning
`0`	Priority tag: priority is meaningful, but there is no VLAN membership.
`1`	Usually the default or native VLAN; deployment-specific.
`2–1005`	Normal 802.1Q VLAN range.
`1006–4094`	Extended range; device support varies.
`4095`	Reserved; must not be used as a VLAN ID.

PCP and VID are independent fields

The 3-bit PCP is a queuing hint and does not select a VLAN. The 12-bit VID selects VLAN membership and does not change the queue by itself. A switch maps PCP to a traffic class through local policy; two frames with the same VID can use different PCP values.

tag stacking changes the offsets

Each 802.1Q/802.1ad tag adds four bytes before the inner EtherType. QinQ frames can carry two tags or more, so a parser must walk the TPID chain instead of assuming the EtherType is always at bytes 12–13. The frame's maximum size grows by four bytes per tag; the 64-byte minimum payload shrinks to 42 bytes with one tag.

04Frame encoder

optional VLAN · padding · FCS

Build an Ethernet II frame and optionally insert an 802.1Q tag, pad the payload to the minimum and append the CRC-32 FCS. A real NIC normally adds the FCS in hardware; the checkbox exists so you can produce a complete on-wire frame for a lab tool.

frame parameters

Ethernet II

destination MAC

source MAC

EtherType 0x0600+

payload presets

payload hex

802.1Q VLAN tag pad to minimum frame append FCS

PCP 0–7

DEI

VID 0–4095

The FCS is calculated over the destination MAC through the end of padding. It is appended as the reflected CRC-32 value, least-significant byte first.

wire output

waiting

Set the fields and press Build frame.

frame hex

no bytes built yet

the FCS is not authentication

CRC-32 detects accidental corruption. It does not stop a sender from forging a frame; use MACsec, IPsec or higher-layer authentication when you need integrity against an attacker.

05Frame decoder

header, VLAN chain, payload, FCS

Paste a frame starting at the destination MAC. An optional 7×55 preamble plus D5 SFD is detected and skipped. Set the FCS mode if your capture is known to include or exclude the trailing CRC; automatic mode strips it only when the CRC validates.

parse bytes

Ethernet II · 802.1Q

hex input frame, optional preamble

FCS mode

No frame decoded yet.

06Wire notes

what packet capture hides

captures are not the wire

The NIC strips the preamble, SFD, interpacket gap and often the FCS before handing the frame to the host. A capture that shows no FCS is normal. A capture taken on a sending host may also show checksum offload artifacts at higher layers.

Destination MAC first. The first six bytes are the receiver's MAC. A broadcast destination is ff:ff:ff:ff:ff:ff; multicast has the I/G bit set in the first octet.
EtherType or length. Values ≥ 0x0600 are EtherTypes; values ≤ 1500 are 802.3 length fields. The 1501–1535 range is undefined.
A VLAN tag is not free. Each tag moves the inner EtherType four bytes right and permits a 1522-byte standard frame. QinQ stacks tags and increases the limit further.
The FCS is little-endian in practice. The reflected CRC-32 value is transmitted least-significant byte first. A receiver that computes CRC over the frame including the FCS sees the residue 0x2144DF1C when it is valid.
Padding is not payload. A 28-byte ARP message is padded to the 46-byte minimum; a protocol parser must trust its own length fields, not the Ethernet frame boundary alone.
MAC addresses are link-local. They are learned and forwarded by switches; they do not survive a router. ARP glues IPv4 to the next-hop MAC.

References

IEEE 802.3Ethernet
IEEE 802.1QVLAN tags
IANA registryEtherTypes
RFC 894IPv4 over Ethernet
RFC 1042IP over IEEE 802
RFC 826ARP

next protocol ARP address resolution ->