Frame
A frame is a Layer 2 (data link) unit of data that includes a header with MAC addresses, the payload (an IP packet), and a trailer with error-checking CRC. Ethernet frames have a maximum size of 1518 bytes. Frames are addressed by MAC, not IP – they do not cross router boundaries.
Definition
A frame is the data unit at the data link layer (OSI Layer 2). Ethernet frames encapsulate IP packets for transmission over a local network segment. The frame header contains source and destination MAC addresses (48-bit each), an EtherType field indicating the payload protocol (0x0800 for IPv4, 0x86DD for IPv6), and optionally 802.1Q VLAN tags. The trailer contains a 4-byte Frame Check Sequence (FCS) – a CRC-32 used by the receiving NIC to detect bit errors from transmission noise. Frames are local to a broadcast domain. When a packet needs to reach a different network, the router strips the incoming frame, routes the IP packet, and encapsulates it in a new frame with new MAC addresses for the next hop.
Examples
- –Ethernet frame: [Dst MAC][Src MAC][EtherType][Payload (46-1500 bytes)][FCS]
- –Wireshark 'frame.len' filter shows frame sizes
- –arp -a shows MAC-to-IP mappings for local frame addressing
Related Protocols
Related Terms
Packet
A packet is a unit of data transmitted over a network. Each packet contains a header (source/destination addresses, protocol info, sequence numbers) and a payload (the actual data). IP packets are limited by MTU – typically 1500 bytes on Ethernet. Larger messages are split into multiple packets.
MTU (Maximum Transmission Unit)
MTU is the largest packet size a network link can carry without fragmentation. Ethernet MTU is 1500 bytes. If a packet exceeds the path MTU, it is fragmented (IPv4) or dropped with ICMP Packet Too Big (IPv6). Path MTU Discovery (PMTUD) finds the lowest MTU along a route.
ARP (Address Resolution Protocol)
ARP resolves IP addresses to MAC addresses on local networks. When a host needs to send a packet to an IP on the same subnet, it broadcasts an ARP request. The target responds with its MAC address. ARP has no authentication – ARP spoofing enables man-in-the-middle attacks on LANs.
VLAN (Virtual LAN)
A VLAN segments a physical switch into multiple isolated broadcast domains using 802.1Q tags. Devices in different VLANs cannot communicate without a router (inter-VLAN routing). VLANs provide security isolation, reduce broadcast traffic, and enable network segmentation without separate physical infrastructure.