This wiki has been migrated to and is now deprecated. Please use that site instead.

Ethernet (IEEE 802.3)

Ethernet is the most common local area networking technology, and, with gigabit and 10 gigabit Ethernet, is also being used for metropolitan-area and wide-area networking.

It is specified by [ various IEEE 802.3 specifications].

Ethernet sends network packets from the sending host to one (["Unicast"]) or more (["Multicast"]/["Broadcast"]) receiving hosts.

A physical Ethernet packet will look like this:


Destination MAC address

Source MAC address


User Data

Frame Check Sequence (FCS)





46 - 1500


As the Ethernet hardware filters the preambel and the FCS, only the green fields are given to Ethereal or any other application.

An Ethernet host is addressed by it's Ethernet MAC address, a 6 byte number usually displayed as: 08:00:08:15:ca:fe (the delimiters vary, so you might see 08-00-08-15-ca-fe or alike). The first three bytes of the address are assigned to a specific vendor, see [ Ethernet numbers] at the ["IANA"] for assigned and special addresses.

A destination MAC address of ff:ff:ff:ff:ff:ff indicates a ["Broadcast"], meaning the packet is send from one host to any other on that network.

XXX - also describe multicast.

Ethernet uses a 16bit type field to indicate which upper layer protocol should be used. Some examples:

Ethernet uses a CyclicRedundancyCheck (CRC) algorithm to detect transmission errors. The FrameCheckSequence field is filled (using a CRC) by the sending host. If the receiving host detects a wrong CRC, it will throw away that packet.


XXX - add a brief description of Ethernet history

Protocol dependencies

Example traffic

XXX - Add example traffic here (as plain text or Ethereal screenshot).


The Ethernet dissector is fully functional.

Preference Settings

(XXX add links to preference settings affecting how Ethernet is dissected).

Example capture file

XXX - Add a simple example capture file. Keep it short, it's also a good idea to gzip it to make it even smaller, as Ethereal can open gzipped files automatically.

Display Filter

A complete list of Ethernet display filter fields can be found in the [ display filter reference]

Capture Filter