Ethernet and MAC Addresses

The previous topic defined how data is wrapped across the layers and named the outermost wrapping the frame. The frame’s contents, though, have not been opened yet: what fields does a frame consist of, and what does the address on it mean?

This lesson’s question is how devices sharing the same physical medium find each other. The answer lies in an addressing scheme that is entirely local, independent of network-layer addresses.

The Ethernet Frame

An Ethernet frame consists of the following fields:

Field	Size	Function
Destination address	6 bytes	Hardware address of the device receiving the frame
Source address	6 bytes	Hardware address of the sending device
Type / length	2 bytes	The payload’s protocol (0x0800 IPv4, 0x86DD IPv6, 0x0806 ARP)
Payload	46–1500 bytes	The network-layer packet being carried
Frame check sequence	4 bytes	Cyclic redundancy check (CRC-32)

Before the frame, a 7-byte preamble and a 1-byte start-of-frame delimiter are placed on the wire; the medium is left idle for 12 bytes between frames. These 20 bytes do not belong to the frame, but they consume time on the wire.

The payload’s lower bound is 46 bytes. If the payload is shorter, padding is added to fill it out to 46. The reason for this bound is collision detection: a frame must take long enough to reach the farthest device on the wire and return, or the sender finishes sending without noticing the collision. Together with the address and type fields, the smallest frame is $6 + 6 + 2 + 46 + 4 = 64$ bytes.

The payload’s upper bound is 1500 bytes — this is the MTU value defined in the previous lesson. The frame’s own headers are outside this bound; the largest frame is 1518 bytes.

The frame check sequence is a cyclic redundancy check computed over the entire frame. Unlike the checksum in the IP header, it also covers the payload and detects bit errors noticeably more strongly. If the check fails, the frame is silently dropped; Ethernet does not retransmit. Noticing and recovering from the loss is the job of the upper layers.

The Structure of the MAC Address

A MAC address (media access control address) is a 48-bit value that addresses a network interface at the physical level. It is written as six hexadecimal bytes separated by colons or hyphens: 00:00:5e:00:53:01.

The address consists of two parts:

• First 3 bytes: the organizationally unique identifier. Assigned to the organization that manufactures the interface.
• Last 3 bytes: the interface number the organization assigns itself.

The first byte’s lowest two bits carry a separate meaning, and are the first thing to check when reading an address:

Bit	Name	If 0	If 1
0 (lowest)	I/G	Unicast address (single interface)	Group address (broadcast or multicast)
1	U/L	Universally administered (assigned by manufacturer)	Locally administered (assigned locally)

The program below decodes these two bits.

def decode_mac(mac: str) -> None:
    bytes_ = [int(x, 16) for x in mac.split(":")]
    first = bytes_[0]
    kind = "group" if first & 0b1 else "unicast"
    source = "local" if first & 0b10 else "universal"
    print(f"{mac}  first byte={first:08b}  {kind:7s}  {source}")


for address in ("00:00:5e:00:53:01",      # client on the example network
              "00:00:5e:00:53:00",      # gateway's internal interface
              "ff:ff:ff:ff:ff:ff",      # broadcast
              "01:00:5e:00:00:01",      # IPv4 multicast
              "33:33:00:00:00:01",      # IPv6 multicast
              "02:00:5e:00:53:2f"):     # locally administered
    decode_mac(address)

Output:

00:00:5e:00:53:01  first byte=00000000  unicast  universal
00:00:5e:00:53:00  first byte=00000000  unicast  universal
ff:ff:ff:ff:ff:ff  first byte=11111111  group    local
01:00:5e:00:00:01  first byte=00000001  group    universal
33:33:00:00:00:01  first byte=00110011  group    local
02:00:5e:00:53:2f  first byte=00000010  unicast  local

The masking operations are a direct application of the method introduced in the Bit-Level Operations lesson of the How Computers Work course: first & 0b1 isolates the lowest bit, first & 0b10 isolates the next one.

Three address classes are distinguished. ff:ff:ff:ff:ff:ff is the broadcast address; every interface on the local network processes this frame. Addresses starting with 01:00:5e:... are for IPv4 multicast, those starting with 33:33:... for IPv6 multicast; only interfaces that joined the relevant group process them. The rest are unicast addresses.

Locally administered addresses are addresses that do not come from a manufacturer: virtual interfaces, container networks, and wireless clients that rotate their address for privacy use this block. In 02:00:5e:00:53:2f, the second bit is set, so the address is local.

The Scope of Addresses

A MAC address is a local address. When a frame passes through a router, the frame is entirely rebuilt: the source address becomes the router’s outgoing interface, and the destination address becomes the next device. The distinction emphasized in the previous topic becomes concrete here — link-layer addresses change at every hop, IP addresses do not.

One consequence of this: a MAC address can be seen only by devices on the same local network. A remote server does not know the hardware address of the client connecting to it.

How a Switch Learns Addresses

A switch is a device that operates at the link layer and forwards frames only to the port they need to reach. It does not know in advance which address is on which port; it learns by observing source addresses.

The rule has three steps:

1. An incoming frame’s source address is written to the table together with the port it arrived on.
2. If the frame’s destination address is in the table, the frame is forwarded only to that port.
3. If the destination address is not in the table, or is a group address, the frame is sent to every port except the one it arrived on. This is called flooding.

On the switch in the example network’s administration section, after the client sends its first frame to the gateway, the table becomes this:

MAC address	Port	How it was learned
00:00:5e:00:53:01	4	Source address of the frame the client sent

The gateway’s address is not yet in the table; the client’s frame goes to every port by flooding. When the gateway responds, its address is learned too:

MAC address	Port	How it was learned
00:00:5e:00:53:01	4	The client’s frame
00:00:5e:00:53:00	1	The gateway’s response frame

Table entries are removed after an aging period; this lets the table correct itself when a device moves to a different port.

One consequence of this learning method is that two addresses are not naturally learned together: if a device has never sent a frame, the switch does not know where it is, and every frame headed to it is flooded.

Collision Domain and Broadcast Domain

Two scope concepts must be distinguished.

A collision domain is the set of devices where a collision can occur if they send at the same time. Every port of a switch is its own collision domain; on a link running full duplex, no collision occurs at all.

A broadcast domain is the set of devices a broadcast frame reaches. Because a switch floods broadcast frames, it does not split the broadcast domain. The device that splits a broadcast domain is the router: a router does not pass broadcast frames to the other side.

This distinction is one of the reasons the example network is split into sections. As the number of devices in a single broadcast domain grows, so does the work each broadcast frame creates: in a hundred-device broadcast domain, one broadcast frame causes ninety-nine unnecessary processing events. Putting the organization’s sections into separate networks limits this load.

The virtual LAN (VLAN) mechanism makes it possible to define multiple broadcast domains on a single physical switch: every port is tagged with an identifier, and frames do not pass between ports with different identifiers. The sections in the example network could just as well be separated this way, on one switch instead of separate switches; the address plan is the same either way.

Summary

• An Ethernet frame consists of a destination address, source address, type field, 46–1500-byte payload, and 4-byte check sequence; the smallest frame is 64 bytes, the largest 1518.
• If the check sequence fails, the frame is silently dropped; recovering the loss is the job of the upper layers.
• A MAC address is 48 bits; the first byte’s lowest bit gives the unicast/group distinction, the next bit the universal/local distinction.
• ff:ff:ff:ff:ff:ff is the broadcast address; the 01:00:5e:... and 33:33:... prefixes are for multicast.
• A switch learns its address table by observing incoming frames’ source addresses; it floods frames with an unknown destination.
• A switch splits collision domains but not the broadcast domain; the device that splits the broadcast domain is the router.

Next Step

To send a frame, the destination’s hardware address must be known. Yet applications specify the destination by IP address; a client knows it will send to 192.168.10.193, but does not know which hardware address that corresponds to. The next lesson covers the address resolution protocol that bridges these two address spaces, and the security gap it leaves behind.