Ethernet isn’t just about plugging in a cable; it’s a surprisingly sophisticated dance of electrical signals and collision detection that makes your wired network hum.
Let’s watch a frame get sent. Imagine two computers, 192.168.1.10 and 192.168.1.11, connected through a switch. 192.168.1.10 wants to send a packet to 192.168.1.11. It first builds an Ethernet frame. This frame starts with a preamble (7 bytes of alternating 1s and 0s, like 10101010...) and a Start Frame Delimiter (SFD, 10101011), which are synchronization signals for the receiver.
Next comes the destination MAC address (00:0C:29:B4:B2:11 for 192.168.1.11), followed by the source MAC address (00:0C:29:B4:B2:10 for 192.168.1.10). After that is the EtherType field, which tells the receiving machine what kind of data is inside the payload. For an IPv4 packet, this would be 0x0800. The payload itself can be between 46 and 1500 bytes. If the actual data is less than 46 bytes, padding is added to meet the minimum. Finally, a Frame Check Sequence (FCS), a 4-byte CRC, is calculated and appended to detect errors.
Here’s what a raw frame might look like in Wireshark (simplified):
Frame 1: 72 bytes on wire (576 bits), 72 bytes captured (576 bits)
...
Ethernet II, Src: 00:0c:29:b4:b2:10, Dst: 00:0c:29:b4:b2:11
Destination: 00:0c:29:b4:b2:11 (00:0c:29:b4:b2:11)
Source: 00:0c:29:b4:b2:10 (00:0c:29:b4:b2:10)
Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 192.168.1.10, Dst: 192.168.1.11
... payload data ...
Frame Check Sequence: 0x12345678 (correct)
The source computer then converts this frame into electrical signals and sends it onto the wire. If the network is a shared medium (like old coaxial cable or a hub), multiple devices might try to transmit at the same time. This is where Carrier Sense Multiple Access with Collision Detection (CSMA/CD) comes in.
Before transmitting, a device "listens" to the wire to see if it’s busy. If it’s clear, it starts sending. If two devices transmit simultaneously, a collision occurs. Both devices detect this abnormal signal voltage, stop transmitting, and send a jam signal to ensure all other devices know a collision happened. They then wait a random amount of time (backoff period) before trying to transmit again. Switches, which are ubiquitous today, largely eliminate collisions by creating dedicated paths between devices, but the underlying principles of frame structure and signaling remain.
The problem Ethernet solves is establishing a reliable way for devices on a local network to exchange data, even in the presence of potential interference or simultaneous transmissions. It defines the physical layer (how bits are represented as electrical signals) and the data link layer (how data is framed and addressed).
The actual transmission of bits involves voltage levels. For 10/100 Mbps Ethernet (using Manchester encoding), a transition in the middle of each bit period signals the bit value: a transition from high to low represents a '1', and low to high represents a '0'. For Gigabit Ethernet and beyond, more complex encoding schemes like 8B10B or PAM-5 are used to pack more data into the same bandwidth by using multiple voltage levels or encoding groups of bits.
The most surprising thing about Ethernet is how its early design, built for shared media and collisions, has been so effectively adapted to modern switched networks where collisions are rare to non-existent. The fundamental frame structure and MAC addressing, however, are still the bedrock of how devices identify and talk to each other on a LAN.
When you configure an IP address like 192.168.1.10 on a network interface, the operating system also assigns a MAC address (e.g., 00:0C:29:B4:B2:10). This MAC address is burned into the network card and is globally unique. The IP address is for logical addressing within a network, while the MAC address is for physical addressing on the local segment, ensuring frames reach the correct hardware.
If you ever need to inspect the raw frames your machine is sending or receiving, the tcpdump command is your best friend. To see all Ethernet frames on your primary interface (eth0), you’d run:
sudo tcpdump -i eth0 -nn
The -nn flag prevents tcpdump from trying to resolve IP addresses to hostnames or port numbers to service names, giving you a raw view of the packet headers, including MAC addresses and EtherTypes.
The next step in the networking journey after understanding Ethernet frames is how these frames are routed across different networks, a concept known as IP routing.