This wiki has been migrated to and is now deprecated. Please use that site instead.

Ethernet (IEEE 802.3)



Ethernet is the most common local area networking technology, and, with gigabit and 10 gigabit Ethernet, is also being used for metropolitan-area and wide-area networking.

It is specified by [ various IEEE 802.3 specifications].

Ethernet sends network packets from the sending host to one (["Unicast"]) or more (["Multicast"]/["Broadcast"]) receiving hosts.

You can find hardware related Ethernet information at the EthernetHardware page.

Information how to capture on an Ethernet network can be found at the ["CaptureSetup/Ethernet"] page.

Packet format

A physical Ethernet packet will look like this:


Destination MAC address

Source MAC address


User Data

Frame Check Sequence (FCS)





46 - 1500


As the Ethernet hardware filters the preamble, only the green fields are given to Ethereal or any other application. Most Ethernet interfaces also either don't supply the FCS to Ethereal or other applications, or aren't configured by their driver to do so.

MAC address fields

Type / Length field

Frame Check Sequence (FCS) field


See [ Wikipedia] for a brief history of Ethernet

Protocol dependencies

Ethernet is the lowest software layer, so it only depends on hardware.

Example traffic

Small portion of the capture from opening in a web browser.

Example capture file

Full capture from above example. Opening from the Firefox browser.


The Ethernet dissector is fully functional.

Preference Settings

(XXX add links to preference settings affecting how Ethernet is dissected).

Display Filter

A complete list of Ethernet display filter fields can be found in the [ display filter reference]

Some useful filters:

Note: the Ethernet Broadcast address (ff:ff:ff:ff:ff:ff) is per definition a Multicast one (least significant bit of first address byte set). If you want to see only Multicasts, you have to filter out the Broadcasts as well  (eth.dst[0] & 1) && eth.dst!=ff:ff:ff:ff:ff:ff .

Capture Filter

Capture only the Ethernet-based traffic to and from Ethernet MAC address 08:00:08:15:ca:fe:

Ethernet ["Multicast"] traffic only:

Ethernet ["Broadcast"] traffic only:

Information how to capture on an Ethernet network can be found at the ["CaptureSetup/Ethernet"] page.

A lot of tutorial information about Ethernet can be found at [ Charles Spurgeon's Ethernet Web Site].