Ethernet frames and MAC addresses

Why frames?

A packet knows its final destination IP address, but on each local link something must say which NIC should pick it up next, and check that it arrived undamaged. That is the job of the Ethernet frame at Layer 2.

The fields of an Ethernet frame

The destination comes first so a switch can start deciding where to send the frame early. If the FCS does not match, the receiver drops the frame silently; TCP higher up notices and resends. The largest payload, 1500 bytes, is called the MTU (Maximum Transmission Unit) of Ethernet.

MAC addresses

A MAC (Media Access Control) address is a 48-bit number that identifies a NIC on a LAN. It is written as 12 hexadecimal digits (0 to 9 and a to f, each worth 4 bits). The same address appears in three common formats:

00:1a:2b:3c:4d:5e     Linux, macOS (colons)
00-1A-2B-3C-4D-5E     Windows (hyphens)
001a.2b3c.4d5e        Cisco IOS (dots, groups of four)

The first 24 bits (first 3 bytes) are the OUI (Organisationally Unique Identifier), bought by the maker from the IEEE. The last 24 bits are given by the maker to each NIC. So 00:1a:2b is the maker part of the address above. Many phones today use a random, private MAC address for each Wi-Fi network for privacy, so do not assume a MAC address never changes.

Unicast, broadcast and multicast

• Unicast: to one NIC. Most frames are unicast.
• Broadcast: to every NIC in the LAN. The address is all ones: ff:ff:ff:ff:ff:ff, written ffff.ffff.ffff on Cisco. ARP requests and DHCP discovers use it.
• Multicast: to a group of NICs that asked for it. You can spot one because the lowest bit of the first byte is 1, which means the first byte is odd. Example: 01:00:5e:00:00:05, used for IPv4 multicast.

Worked example: first byte 0x01 is binary 00000001, last bit 1, so it is a group (multicast) address. First byte 0x00 ends in 0, so unicast. First byte 0x33 (used for IPv6 multicast) is 00110011, odd, so multicast. Broadcast is a special group address that includes everyone.

Speed, duplex and auto-negotiation

Duplex is about direction. Half duplex means a device can send or receive, but not both at once, like a walkie-talkie; it was needed with hubs. Full duplex means send and receive at the same time, like a phone call; switches use it. Speed is 10, 100, 1000 Mbps and so on.

Auto-negotiation lets the two ends agree the best speed and duplex they both support. Leave it on at both ends. If you set speed and duplex by hand on one side and leave the other on auto, the auto side can usually detect the speed but not the duplex; at 10 or 100 Mbps it falls back to half duplex.

The result is a duplex mismatch: one side full, the other half. The link stays up, so it looks fine, but it is very slow. The half-duplex side shows late collisions; the full-duplex side shows FCS or CRC errors and runts (frames shorter than 64 bytes).

Switch# show interfaces g0/1
GigabitEthernet0/1 is up, line protocol is up (connected)
  Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 output errors, 0 collisions, 0 late collision