5. Ethernet, MAC addresses, and frames

5.1 The MAC address

A MAC (Media Access Control) address is a 48-bit identifier burned into (or assigned to) a network interface. Written as six hex octets: a4:83:e7:2b:19:0c.

Structure:

 a4:83:e7 : 2b:19:0c
 |______|   |______|
 OUI (vendor)  NIC-specific

• First 24 bits = OUI (Organizationally Unique Identifier), assigned by IEEE to the manufacturer. a4:83:e7 = Apple, 00:1a:11 = Google, 52:54:00 = QEMU/KVM virtual NICs.
• Two special bits in the first octet:
  • I/G bit (least significant bit of first octet): 0 = unicast, 1 = multicast. ff:ff:ff:ff:ff:ff = broadcast.
  • U/L bit (second-least-significant): 0 = globally unique (OUI-based), 1 = locally administered. Randomized Wi-Fi MACs and most VMs set this bit — that's why a randomized phone MAC looks like 9a:... or d6:... (second hex digit is 2, 6, A, or E).

MAC addresses are flat (no hierarchy, no aggregation) and only meaningful on the local link. A packet's MAC addresses are rewritten by every router it crosses; its IP addresses are not (barring NAT).

5.2 The Ethernet II frame format

+-----------+-----------+-----------+-------------------+---------+
| Dst MAC   | Src MAC   | EtherType | Payload           | FCS     |
| 6 bytes   | 6 bytes   | 2 bytes   | 46-1500 bytes     | 4 bytes |
+-----------+-----------+-----------+-------------------+---------+
        (preamble + SFD, 8 bytes, added by hardware, not counted)

• EtherType ≥ 0x0600 identifies the payload protocol (0x0800 IPv4, 0x86DD IPv6, 0x0806 ARP, 0x8100 802.1Q VLAN tag). Values ≤ 0x05DC mean the field is instead a length (old 802.3 framing).
• Payload minimum 46 bytes: frames shorter than 64 bytes total collide-detect incorrectly on legacy half-duplex Ethernet, so short payloads are padded. A 1-byte TCP ACK's payload is padded to 46; Wireshark shows "trailer" bytes.
• FCS (Frame Check Sequence): a CRC-32 over the frame. On mismatch the NIC silently drops the frame and increments an error counter. Ethernet does not retransmit — that's TCP's job.
• MTU (Maximum Transmission Unit) = the max payload = 1500 bytes for standard Ethernet. This single number propagates constraints all the way up to TCP's MSS.

5.3 With a VLAN tag (802.1Q)

| Dst MAC | Src MAC | 0x8100 | PCP/DEI/VID (2B) | EtherType | Payload | FCS |

The 4-byte tag carries a 12-bit VLAN ID (1–4094) and a 3-bit PCP (priority, used for QoS — Ch. 51). This is why VLAN-tagged frames can reach 1518 or 1522 bytes and trip strict MTU checks.

5.4 How a host decides: local or remote?

Before sending an IP packet, the stack computes (destination_IP AND local_netmask) == (local_IP AND local_netmask):

• Equal → destination is on my link. ARP for the destination's own MAC, send directly.
• Not equal → destination is remote. ARP for the gateway's MAC, send the frame there; the IP header still holds the final destination IP.

Example: laptop 192.168.1.50/24 sending to 192.168.1.99 → same /24, direct. Sending to 8.8.8.8 → different, send to gateway MAC.

5.5 Duplex, autonegotiation, and the classic mismatch

Modern Ethernet is full duplex (send and receive simultaneously, no collisions). Autonegotiation picks speed (10/100/1000/…) and duplex. If one side is hard-set to 100/full and the other autonegotiates, the autoneg side falls back to 100/half → duplex mismatch: works at low load, throws CRC errors + late collisions and collapses throughput under load. Always set both ends the same way (usually: autoneg on both).

5.6 War story

A monitoring host showed 0.5% packet loss to one server, steady for months. ethtool -S eth0 on the switch-facing NIC showed rx_crc_errors climbing. A half-crimped RJ45 connector was corrupting ~1 frame in 200. TCP hid it (retransmits) until a backup job needed line-rate and throughput cratered to 6 Mbit/s. Lesson: Layer 1 errors masquerade as Layer 4 performance problems. Check NIC error counters early.

Try it yourself

ip -br link                       # interface names, MACs, up/down
ethtool eth0                      # speed, duplex, autoneg
ethtool -S eth0 | grep -Ei 'err|drop|crc|collision'   # hardware error counters
cat /sys/class/net/eth0/mtu      # link MTU
ip neigh                         # the ARP/neighbor cache