Regardless of the frame type being used, the means of digital signal encoding on an Ethernet network is the same. On an idle Ethernet network, there is no signal. Because each station has its own oscillating clock, the communicating stations have to have some way to "synch up" their clocks and thereby agree on how long one bit time is. The preamble facilitates this.

The preamble consists of 8 bytes of alternating ones and zeros, ending in 11. A station on an Ethernet network detects the change in voltage that occurs when another station begins to transmit, and uses the preamble to "lock on" to the sending station's clock signal. Because it takes some amount of time for a station to "lock on", it does not know how many bits of the preamble have gone by. For this reason, we say that the preamble is "lost" in the "synching up" process. No part of the preamble ever enters the adapter's memory buffer. Once locked on, the receiving station waits for the 11 that signals that the Ethernet frame follows.

Most modern Ethernet adapters are guaranteed to achieve a signal lock within 14 bit-times.

Ethernet Version II

Offset 0-5: The Destination Address

The first six bytes of an Ethernet frame make up the Destination Address. The Destination Address specifies to which adapter the data frame is being sent. A Destination Address of all ones specifies a Broadcast Message that is read in by all receiving Ethernet adapters. The first three bytes of the Destination Address are assigned by the IEEE to the vendor of the adapter, and are specific to the vendor. The Destination Address format is identical in all implementations of Ethernet.

Offset 6-11: The Source Address

The next six bytes of an Ethernet frame make up the Source Address. The Source Address specifies from which adapter the message originated. Like the Destination Address, the first three bytes specify the vendor of the card. The Source Address format is identical in all implementations of Ethernet.

Offset 12-13: The Ethertype

Following the Source Address is a 2 byte field called the Ethertype. The Ethertype is analogous to the SAPs in the 802.3 frame in that it specifies the memory buffer in which to place this frame. An interesting question arises when one considers the 802.3 and Version II frame formats: Both formats specify a 2 byte field following the source address (an Ethertype in Version II, and a Length field in 802.3) -- How does a driver know which format it is seeing, if it is configured to support both? The answer is actually quite simple. All Ethertypes have a value greater than 05DC hex, or 1500 decimal. Since the maximum frame size in Ethernet is 1418 bytes, there is no point of overlap between Ethertypes and lengths. If the field that follows the Source Address is greater than O5DC hex, the frame is a Version II, otherwise, it is something else (either 802.3, 802.3 SNAP, or Novell Proprietary).

User Data and FCS Data: 46-1497 Bytes

Following the 802.2 header are 46 to 1,497 bytes of data, generally consisting of upper layer headers such as TCP/IP or IPX and then the actual user data.

FCS: Last 4 Bytes

The last 4 bytes that the adapter reads in are the Frame Check Sequence or CRC. When the voltage on the wire returns to zero, the adapter checks the last 4 bytes it received against a checksum that it generates via a complex polynomial. If the calculated checksum does not match the checksum on the frame, the frame is discarded and never reaches the memory buffers in the station.

802.3

Offset 0-5: The Destination Address

The first six bytes of an Ethernet frame make up the Destination Address. The Destination Address specifies to which adapter the data frame is being sent. A Destination Address of all ones specifies a Broadcast Message that is read in by all receiving Ethernet adapters. The first three bytes of the Destination Address are assigned by the IEEE to the vendor of the adapter, and are specific to the vendor. The Destination Address format is identical in all implementations of Ethernet.

Offset 6-11: The Source Address

The next six bytes of an Ethernet frame make up the Source Address. The Source Address specifies from which adapter the message originated. Like the Destination Address, the first three bytes specify the vendor of the card. The Source Address format is identical in all implementations of Ethernet.

Offset 12-13: Length

Bits 13 and 14 of an Ethernet frame contain the length of the data in the frame, not including the preamble, 32 bit CRC, DLC addresses, or the Length field itself. An Ethernet frame can be no shorter than 64 bytes total length, and no longer than 1518 bytes total length.

The 802.2 LLC Header

Following the Data Link Header is the Logical Link Control Header, which is described in the IEEE 802.2 Specification. The purpose of the LLC header is to provide a "hole in the ceiling" of the Data Link Layer. By specifying into which memory buffer the adapter places the data frame, the LLC header allows the upper layers to know where to find the data.

Offset 15: The DSAP

The DSAP, or Destination Service Access Point, is a 1 byte field that simply acts as a pointer to a memory buffer in the receiving station. It tells the receiving NIC in which buffer to put this information. This functionality is crucial in situations where users are running multiple protocol stacks, etc...

Offset 16: The SSAP

The SSAP, or Source Service Access Point is analogous to the DSAP, and specifies the Source of the sending process.

Offset 17: The Control Byte

Following the SAPs is a one byte control field that specifies the type of LLC frame that this is.

User Data and FCS Data: 43-1497 Bytes

Following the 802.2 header are 43 to 1,497 bytes of data, generally consisting of upper layer headers such as TCP/IP or IPX and then the actual user data.

FCS: Last 4 Bytes

The last 4 bytes that the adapter reads in are the Frame Check Sequence or CRC. When the voltage on the wire returns to zero, the adapter checks the last 4 bytes it received against a checksum that it generates via a complex polynomial. If the calculated checksum does not match the checksum on the frame, the frame is discarded and never reaches the memory buffers in the station.