GuideFundamentalsLayer 2

Ethernet: Frames, MAC Addresses, Switching and LAN Operation

Learn how Ethernet works below IP: frame structure, MAC addresses, switching decisions, full duplex, MTU, media, and delivery inside a LAN.

All networking guidesNetwork architecture

What is Ethernet?

Ethernet is the dominant family of technologies for wired local-area networks. It defines how devices send frames over a link, how Layer 2 addresses identify interfaces, and how switches forward traffic inside a LAN. Modern Ethernet exists across copper and fiber at speeds ranging from megabits to hundreds of gigabits per second, but the core forwarding model is still recognizable.

Ethernet is local in scope. An Ethernet frame is useful on the current Layer 2 segment; when traffic crosses a router, a new Layer 2 frame is built for the next hop while the IP packet continues toward its destination.

Where Ethernet fits in OSI and TCP/IP

Ethernet spans Layer 2 and Layer 1 concepts. The MAC sublayer, frame format, addressing, and switching are data-link functions. Signaling, connectors, wavelengths, encoding, and physical media belong to the physical layer.

In the TCP/IP model, these functions are usually grouped into the Link or Network Access layer. See the OSI and TCP/IP guide for the broader map.

What is inside an Ethernet frame?

A standard Ethernet frame carries a destination MAC address, source MAC address, an EtherType or length field, payload, and a frame check sequence (FCS). On 802.1Q trunks, a VLAN tag is inserted so switches can preserve VLAN membership across the link.

  • Destination MAC: identifies the intended local recipient, a multicast group, or broadcast.
  • Source MAC: identifies the sender on the current Layer 2 segment.
  • EtherType: commonly indicates IPv4, IPv6, ARP, or another payload protocol.
  • Payload: usually an IP packet or another Layer 3/control message.
  • FCS: allows receivers to detect corrupted frames.

MAC addresses: identity on the local link

Ethernet MAC addresses are normally 48 bits and are written as six hexadecimal octets. They are used for local frame delivery, not for Internet-wide routing. A host sending to a local IPv4 neighbor uses ARP to discover the destination MAC. A host sending to a remote IP network resolves the MAC address of its next hop, usually the default gateway.

Learn the complete process in MAC addresses and ARP.

What does an Ethernet switch do?

A switch learns source MAC addresses on incoming frames and associates them with ports in its MAC address table. For each frame it then decides where to forward it.

Known destination

If the destination MAC is known on another port in the same VLAN, the switch forwards the frame only where needed.

Unknown destination

If the destination is unknown, the switch floods the frame within the VLAN, except back out the incoming port. Once the destination replies, the switch can learn its location.

Broadcast

Broadcast frames are flooded within the broadcast domain. Routers do not normally forward Layer 2 broadcasts between IP networks.

Full duplex and the historical role of CSMA/CD

Classic shared Ethernet used half duplex and CSMA/CD to detect and handle collisions. Modern switched Ethernet normally uses point-to-point full-duplex links, so each endpoint can transmit and receive simultaneously and collision detection is not used on those links.

Duplex mismatches were once a common operational problem. Today auto-negotiation usually prevents them, but interface counters and negotiated parameters are still worth checking when performance is unexpectedly poor.

Ethernet speeds, names, and media

Ethernet standards combine speed, signaling, and media. Familiar examples include 100BASE-TX, 1000BASE-T, 10GBASE-SR, and many faster variants. Copper is convenient for endpoint access and can deliver PoE, while fiber provides longer reach, electrical isolation, and high capacity for uplinks and backbones.

The transmission media guide compares copper, fiber, and wireless design considerations.

MTU, payload, and why frame size matters

On common Ethernet networks the IP MTU is 1500 bytes. The Ethernet frame itself includes additional Layer 2 overhead. Larger frames may be supported in specific environments, but every device on the path must handle the chosen size consistently.

An MTU mismatch can cause loss, fragmentation in IPv4, or Path MTU Discovery problems. Do not confuse Ethernet frame size with TCP MSS: MSS describes TCP payload size, while MTU describes the maximum Layer 3 packet carried without exceeding the link limit.

How Ethernet and IP work together

IP chooses the logical destination and routing path; Ethernet delivers the packet across each local hop. If a host wants to reach another device in the same subnet, it frames the packet directly to that neighbor's MAC address. If the destination is remote, it frames the packet to the gateway's MAC address instead.

At the router, the incoming frame is removed, the IP packet is processed, and a new frame is created for the outgoing interface. This distinction explains why MAC addresses change hop by hop while source and destination IP addresses usually remain end to end.

Ethernet problems worth recognizing

  • Physical link down or unstable negotiation.
  • CRC/FCS errors caused by cabling, optics, or physical-layer faults.
  • Wrong VLAN assignment or trunk configuration.
  • Loops that trigger broadcast storms when Layer 2 protections fail.
  • MAC table instability or unexpected flooding.
  • MTU inconsistencies across a path.
  • Oversubscribed uplinks or congestion that appears as packet loss and latency.

What to study after Ethernet

Continue with MAC and ARP to understand local neighbor discovery, then move into switching, VLANs, trunks, and spanning tree. Ethernet becomes much easier once you connect frame forwarding with IP addressing and routing.

Technical references

Ethernet is standardized by the IEEE 802.3 family, while VLAN tagging and bridging functions are covered by IEEE 802.1 standards. Specific physical variants have their own requirements for media, distance, and signaling.