Ethernet Protocol Data Units (Packets)

Introduction
User data payloads sent using Ethernet are encapsulated in an Ethernet Protocol Data Unit
(PDU). This document explains the structure of the Ethernet Protocol Data Unit so that you
can write your own software for sending payloads of user data over the Ethernet logical
topology. At the end of the document we will examine an Ethernet PDU that can be used to
wake up a machine on a LAN accoding to the Wake On Lan standard. The Ethernet Protocol
Data Unit is also known as an Ethernet Packet or Ethernet Data Unit. For the remainder of
this document we will use the term Ethernet Packet.
Ethernet packets are transmitted as a bit-serial sequence of fields in order from left to right.
Each field consists of one or more octets (bytes). Each octet received is processed starting
from its least significant bit. In other words, the Ethernet packet is transmitted in a bit-serial
fashion from its most to least significant octet and that each octet is processed by the receiver
starting with the least significant bit. The simplest way to restate this is that an Ethernet
packet is sent from left to right and processed byte by byte from right to left by the receiver.
An Ethernet packet has three main fields:
Header Frame Footer

The Ethernet Packet Header

The Ethernet packet header has four primary responsibilities:
 Facilitate Ethernet packet collision detection
 Establish bit-level synchronization of the receiver clock with that of the transmitter
 Establish byte-level synchronization of the receiver clock with that of the transmitter
 Mark the beginning of the Ethernet frame
The Ethernet packet header is divided into two main fields:
Preamble (7 octets) Start Frame Delimiter (1 octet)
The preamble or syncword is a 7-octet field of alternating 1s and 0s. It establishes bit-level
synchronization of the receiver clock with that of the transmitter and facilitates collision
detection. In hexadecimal, the preamble takes the following form:
0xAA 0xAA 0xAA 0xAA 0xAA 0xAA 0xAA
The start frame delimiter establishes byte-level syncrhonization of the receiver clock with that
of the transmitter and marks the start of the Ethernet frame. In hexadecimal it has the value:
0xAB
The Ethernet packet header has the following value in hexadecimal:
0xAA 0xAA 0xAA 0xAA 0xAA 0xAA 0xAA 0xAB
The Ethernet Packet Frame
The Ethernet packet frame has the following structure:
Dest. MAC Src. MAC VLAN Tag Ethertype / Payload FCS
(6 octets) (6 octets) (4 octets) Size (up to 1500 (4 octets)
(2 octets) octets)
Dest. MAC
This field is a 6-octet field identifying the intended recipient of the Ethernet packet.
Src. MAC
This field is a 6-octet field containing the MAC address of the originator of the Ethernet
packet.
VLAN Tag
The optional IEEE 802.1Q tag or IEEE 802.1ad tag, if present, is a four-octet field that
indicates virtual LAN (VLAN) membership and IEEE 802.1p priority. The first two octets of the
tag are called the Tag Protocol IDentifier (TPID) and double as the EtherType field indicating
that the frame is either 802.1Q or 802.1ad tagged. 802.1Q uses a TPID of 0x8100. 802.1ad
uses a TPID of 0x88a8.
Ethertype / Size
This is is a two-octet number in the range of [0,65535]. This range is actually broken into two
ranges to indicate either a length or an EtherType. If the number is in the range [0,1500], it
indicates a length in octets of the payload and this is used for IEEE 802.3. If the number is in
the range [1501,65535], it indicates an Ethertype for Ethernet 2 and identifies which network
or transport layer protocol encapsulates the frame payload. However a protocol need not
encapsulate the payload. If an Ethertype of 0x0842 is used, this indicates a magic packet
which can be sent uncapsulated in the payload. When an Ethertype is used, the length of the
frame is determined by the location of the interpacket gap and a valid frame check sequence
(FCS).
Payload
The payload or user data is where you place either raw data or data encapsulated in a
network or transport layer protocol packet. The minimum payload is 42 octets when an
802.1Q tag is present and 46 octets when absent. When the actual payload is less, padding
bytes are added accordingly to the end of the buffer sent. The maximum payload is 1500
octets. Non-standard jumbo frames allow for larger maximum payload size.
Frame Check Sequence (FCS)
This is a 4-octet field that holds a cyclic redundancy check value computed using the left-
shifting CRC32 BZIP2 algorithm. According to the standard, the FCS value is computed as a
function of the protected MAC frame fields: source and destination address, length/type field,
and payload (that is, all fields except the FCS).
CRC = crc32(destination MAC, source MAC, length/type, payload)

Ethernet Packet Footer

In computer networking, a minimal pause may be required between network packets or
network frames. This time between packets is known as the interpacket gap (IPG),
interframe spacing, or interframe gap (IFG). Depending on the physical layer protocol or
encoding used, the pause may be necessary to allow for receiver clock recovery, permitting
the receiver to prepare for another packet (e.g. powering up from a low-power state) or
another purpose.
Ethernet devices must allow a minimum idle period between transmission of Ethernet
packets. A brief recovery time between packets allows devices to prepare for reception of the
next packet. While some physical layer variants literally transmit nothing during the idle
period, most modern ones continue to transmit an idle pattern signal. The standard minimum
interpacket gap for transmission is 96 bit times (the time it takes to transmit 96 bits of data on
the medium), which is:
 9.6µs for 10 Mbit/s Ethernet,
 0.96µs for 100 Mbit/s (Fast) Ethernet,
 96ns for Gigabit Ethernet,
 38.4ns for 2.5 Gigabit Ethernet,
 19.2ns for 5 Gigabit Ethernet,
 9.6ns for 10 Gigabit Ethernet,
 3.84ns for 25 Gigabit Ethernet,
 2.4ns for 40 Gigabit Ethernet,
 1.92ns for 50 Gigabit Ethernet,
 0.96ns for 100 Gigabit Ethernet,
 0.48ns for 200 Gigabit Ethernet, and
 0.24ns for 400 Gigabit Ethernet.
Some manufacturers design adapters with a smaller interpacket gap for slightly higher data
transfer rates. That can lead to data loss when mixed with standard adaptors. On reception,
some interpacket gaps may be smaller due to variable network delays, clock tolerances, and
the presence of repeaters (10 and 100 Mbit/s only).
 For 40, 50, 100, 200, and 400 Gigabit Ethernet received IPG can be reduced to a
period of 8 bit times (1 byte).
 For 2.5, 5, 10, and 25 Gigabit Ethernet received IPG can be reduced to a period of 40
bit times (5 bytes).
 For Gigabit Ethernet received IPG can be reduced to a period of 64 bit times (8 bytes).
 For Fast Ethernet received IPG reduction is not specified. Standard is 96 bit times (12
bytes).
 For Classic Ethernet received IPG can be reduced to a period of 47 bit times.
For Fast Ethernet, the interpacket gap of 12 octets would appear as:
0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00

Magic Packets
In October 1996, Intel and IBM formed the Advanced Manageability Alliance (AMA). In April
1997, this alliance introduced the Wake-on-LAN technology. Wake-on-LAN ("WOL") is
implemented using a specially designed frame called a magic packet, which is sent to all
computers in a network, among them the computer to be awakened. The magic packet
contains the MAC address of the destination computer, an identifying number built into each
network interface card ("NIC") or other ethernet device in a computer, that enables it to be
uniquely recognized and addressed on a network. Powered-down or turned off computers
capable of Wake-on-LAN will contain network devices able to "listen" to incoming packets in
low-power mode while the system is powered down. If a magic packet is received that is
directed to the device's MAC address, the NIC signals the computer's power supply or
motherboard to initiate system wake-up, in the same way that pressing the power button
would do. The magic packet is a frame that is most often sent as a broadcast and that
contains anywhere within its payload 6 bytes of all 255 (FF FF FF FF FF FF in hexadecimal),
followed by sixteen repetitions of the target computer's 48-bit MAC address, for a total of 102
bytes. Since the magic packet is only scanned for the string above, and not actually parsed
by a full protocol stack, it could be sent as payload of any network- and transport-layer
protocol, although it is typically sent as a UDP datagram to port 0 (reserved port number), 7
(Echo Protocol) or 9 (Discard Protocol),[7] or directly over Ethernet as EtherType 0x0842. A
connection-oriented transport-layer protocol like TCP is less suited for this task as it requires
establishing an active connection before sending user data.

Here is an example of a magic packet:

FF FF FF FF FF FF A8 61 0A AE 67 32 08 42 FF FF FF FF FF FF 00 30 48 97 D3 FE 00 30
48 97 D3 FE 00 30 48 97 D3 FE 00 30 48 97 D3 FE 00 30 48 97 D3 FE 00 30 48 97 D3 FE
00 30 48 97 D3 FE 00 30 48 97 D3 FE 00 30 48 97 D3 FE 00 30 48 97 D3 FE 00 30 48 97 D3
FE 00 30 48 97 D3 FE 00 30 48 97 D3 FE 00 30 48 97 D3 FE 00 30 48 97 D3 FE 00 30 48 97
D3 FE 69 4A 00 E5

Magic Packet Frame Color Code

Color Field
Destination MAC
Source MAC
Ethertype (0842 = magic packet)
Payload
FCS (CRC-32 BZIP2)

The total size of this frame is 120 bytes.

Layer 1, the physical layer takes care of the preamble the start frame delimiter (Ethernet PDU
header) and the inter packet gap (Ethernet PDU footer).