Ethernet Frame

Frame structure

[ Preamble ] [ Dst MAC ] [ Src MAC ] [ EtherType ] [    Payload    ] [ FCS ]

     7+1         6           6            2          46 - 1500          4

• Preamble + SFD (8 bytes): physical-layer synchronization; rarely visible in tcpdump output because the NIC strips it before passing the frame up
• Dst MAC / Src MAC: see mac-address
• EtherType: identifies the payload protocol:
  • 0x0800 - IPv4
  • 0x0806 - arp
  • 0x86DD - IPv6
  • 0x8100 - 802.1Q VLAN tag
• Payload: the actual content (an IP packet in most cases)
• FCS: Frame Check Sequence (CRC32) for integrity verification; the NIC checks it automatically, and tcpdump normally does not show it

MTU and fragmentation

MTU (Maximum Transmission Unit) is the maximum payload size of a frame. Standard Ethernet is 1500 bytes. That space breaks down as:

• 20 bytes IPv4 header
• 20 bytes TCP header (no options)
• 1460 bytes available for TCP payload, which is the MSS (Maximum Segment Size)

If an IP packet exceeds the MTU and the DF (Don't Fragment) bit is not set, the router splits it into fragments. In IPv6, fragmentation happens only at the source (ICMP "Packet Too Big" tells the sender to reduce its packet size).

Lower MTU values appear in VPN tunnels (IPsec/WireGuard ~1420), PPPoE (~1492). Jumbo frames go up to 9000 bytes, used inside data centers to reduce header overhead.

Knowing your MTU matters for performance. Packets larger than the MTU are dropped without any explicit error at the application level, especially through VPNs.

VLAN tagging

When a frame travels over a trunk link carrying multiple VLANs, a 4-byte 802.1Q tag is inserted between Src MAC and EtherType. The tag carries the VLAN ID and priority bits. EtherType becomes 0x8100, and the original EtherType (0x0800 for IP) follows after the tag.

You can see this as eth0.100 (VLAN 100 on eth0), or explicitly with tcpdump -e:

vlan 100, p 0, ethertype IPv4 (0x0800), 10.0.0.1 > 10.0.0.2: ...

Where to look

In the arp table you find IP-to-MAC pairs. In [[#cmd-tcpdump|tcpdump]] output with the -e flag you see frame headers. In /sys/class/net/<iface>/mtu you read the current MTU.