Ethernet Frame - Format, Header Fields, and Payload Type
An Ethernet frame is the data-link layer container used on many local networks. It carries MAC addresses, a payload type, and the bytes for the next protocol layer.
Key Takeaways
Ethernet II uses destination MAC, source MAC, and EtherType before payload.
EtherType identifies payloads such as IPv4, ARP, IPv6, or VLAN tags.
Frame analysis is the first step when decoding full packet hex.
MAC address interpretation connects packet bytes to devices and vendors.
Ethernet frame layout
In Ethernet II, the visible header starts with 6 bytes of destination MAC address, 6 bytes of source MAC address, and 2 bytes of EtherType. The payload follows immediately after that header.
Why EtherType matters
EtherType tells the parser what the payload contains. A frame carrying IPv4, IPv6, ARP, or VLAN-tagged traffic must be decoded differently after the Ethernet header.
How to analyze an Ethernet frame
Read the MAC addresses first, check whether either address is multicast or locally administered, then use EtherType to choose the next decoder. If the frame is VLAN-tagged, read the inner EtherType after the VLAN tag.
Practical Reference
| Item | Value | Analysis Note |
|---|---|---|
| Destination MAC | 6 bytes | The local recipient or multicast group. |
| Source MAC | 6 bytes | The sender on the local link. |
| EtherType | 2 bytes | Identifies the payload protocol. |
| Payload | Variable | Often IPv4, IPv6, ARP, or VLAN-tagged data. |
FAQ
Is an Ethernet frame the same as an IP packet?
No. The Ethernet frame is the link-layer container. An IP packet is often the payload inside that frame.
Where is the Ethernet header in a hex dump?
If the dump includes the link layer, the Ethernet header is usually the first 14 bytes for Ethernet II without VLAN tags.