TechKnowSurge
Cisco CCNA 1.13 CompTIA Network+ 1.1 Cisco CCST Networking 4.5 Cisco CyberOps Associate 4.8 CompTIA Network+ 2.2
TechKnowSurge Catalog Videos Ethernet Header & Trailer
VideoNetworkFree

Ethernet Header & Trailer

An Ethernet frame is the Layer 2 data unit responsible for moving information across a network, structured with a header, payload, and trailer that together ensure accurate delivery between devices. Its key fields include destination and source MAC addresses, an optional VLAN tag, a type or length indicator, and a Frame Check Sequence that validates data integrity on arrival.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

An Ethernet frame is the fundamental Layer 2 data unit used to move information between devices on a network, and its structure defines how that data is packaged, addressed, and verified during transmission. Frames range in size from 64 to 1,522 bytes and are divided into three sections: a header, a payload, and a trailer. The header carries the addressing and classification information a network needs to forward the frame correctly, while the trailer provides a mechanism for confirming that the frame was not corrupted in transit. Within the header, the destination MAC address tells switches where to forward the frame, and the source MAC address serves two purposes: it allows switches to build and maintain a table mapping devices to specific ports, and it gives the receiving host the information it needs to send a reply. The optional 802.1Q tag, four octets in length, appears on networks that use VLANs to segment traffic, identifying which logical network segment a frame belongs to. The type or length field can indicate either the size of the payload or the protocol type of the encapsulated data, depending on its value. The payload itself carries data from OSI layers 3 through 7, including IP packet headers, transport segment headers, and application data, making it the actual content the frame is transporting from one point to another. At the end of the frame, the Frame Check Sequence acts as an integrity check. When the frame is created, its contents are run through an encoding process that produces a value stored in the FCS field. When the frame arrives at its destination, the same process is applied and the result is compared against that stored value. If the two match, the frame is considered intact; if they do not, the frame is discarded. This mechanism accounts for the reality that physical transmission is not perfect and that bit errors can occur as signals travel across a medium.

What you'll learn

What's covered

Ethernet Frame

Aligned to

Cisco CCNA
1.13 Describe switching concepts
CompTIA Network+
1.1 Explain concepts related to the Open Systems Interconnection (OSI) reference model.
2.2 Given a scenario, configure switching technologies and features.
Cisco CCST Networking
4.5 Explain basic switching concepts
Cisco CyberOps Associate
4.8 Interpret the fields in protocol headers as related to intrusion analysis

Key terms

Ethernet Frame
The Layer 2 data unit used on Ethernet networks, containing a preamble, source and destination MAC addresses, an EtherType field identifying the Layer 3 protocol, a payload (typically an IP packet), and a 4-byte FCS for error detection. Switches use the MAC addresses in Ethernet frames to make forwarding decisions.
Media Access Control
MAC
A sublayer of the Data Link layer that controls how devices on a network gain access to a medium and transmit data.
Data Link Layer
Layer 2 of the OSI model responsible for node-to-node data transfer and error detection on a single network segment.
Payload
The actual data content of a packet or message, excluding headers and metadata.
Virtual LAN
VLAN
A logical grouping of network devices that behave as if they are on the same network regardless of physical location.
Frame Check Sequence
FCS
A cyclic redundancy check value appended to the end of a data link frame that allows the receiver to detect transmission errors. The sending device calculates the FCS from the frame contents, and the receiving device recalculates it; a mismatch means the frame was corrupted and should be discarded.
Switch
A network device that connects devices within a LAN and forwards traffic based on MAC addresses.
802.1Q Tag
An optional four-octet field inserted into an Ethernet frame header to identify which VLAN the frame belongs to.

Transcript

As an Ethernet frame is being put onto the line and sent out, it's going to create this Ethernet frame to go out to the next destination. So what does an Ethernet frame consist of, and what are its separate components?

Here we have an Ethernet frame. The Ethernet frame exists everywhere from the header all the way back to the trailer. We call this the layer 2 Ethernet frame. The layer 2 Ethernet frame can be anywhere from 64 bytes to 1,522 bytes. We're going to be talking about how that looks a little bit later on, but for now just know that we've got the payload within here. We've got a destination MAC address, a source MAC address, a tag, a type, and a trailer. So we end with a trailer. This front part right here is the header, and the header is everything that's needed for this frame to be delivered to its destination, versus the trailer, which has some information to check to make sure that the frame arrives at the other end successfully.

The payload

The payload is what data is going to be transferred. The payload has data from the upper layers, so layer 3, four, five, six and seven is going to be within here. Even the packet from layer 3 — that header is going to be included in there. The segment header is going to be in there. So the payload is all of the data that it's trying to get from one point to the next point.

Destination and source MAC addresses

Within this Ethernet frame header we have both the destination MAC address and the source MAC address, both being six octets long, and an example of that we saw in a prior slide.

The destination MAC address is needed so that when it sends out, that switch is going to know where to forward that information on to the next place, so that it can get to its destination. So the destination MAC address is so it can actually get to that destination.

The source MAC address is needed for a couple of reasons. Number one is that switch needs to learn what devices there are and what ports those devices are on, so it uses that source MAC address information to learn where different devices are on the network. The other thing is that once it gets to its destination, the end machine is going to need to know how to form a reply. That information right there allows the end machine to know who's communicating to it and how it's going to form a reply to that other machine.

The tag

The tag you can see is grayed out. It is four octets long, and it's grayed out because it's optional. You will see this on networks that have VLANs set up, so that it can determine which traffic is associated with which segment. That is where the tag comes in, and we call that 802.1Q tagging on there. We'll talk more about tagging later on. It's not something you necessarily need to know right away, but know that there are some networks that will have that tagging involved in it. Probably not something like your home network, but it does exist out there.

Type or length

Then we have the type/length. I've got it labeled on here as the type, but it also could be the length. It actually could represent two different things on here. If it represents the length, it represents the length that is being sent across, so that the devices and the switches know what length is being sent across and know how to deal with it. But if it is the type that's being sent across, then it knows what the payload is. So it could represent both things.

If it is the type, if it's representing what the payload is, a symbol of what the payload is, then we have to have some sort of gap at the end here, some sort of trailer, to signify the end of this frame as it goes through these different devices.

The frame check sequence

Then we have the frame check sequence. The frame check sequence is a trailer at the end. What happens is this information within here goes through some sort of encoding, and then when it gets to the other side it double-checks that encoding to make sure that the information was unaltered. This is a check to make sure — physical stuff is happening along the way. We're transmitting data through, trying to manipulate elements, and it doesn't always get it right. So when we send this information through, there's that extra little check that happens, just as a "hey, did it get to me in the proper form?" It goes through and does this frame check sequence to ensure that the frame is accurate and it got to the end device.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →