In the last installment of Networking, we discussed the Open Systems Interconnection (OSI) reference model, a tool that explains the internal functions of a network communication system at each of seven layers. This part of our series on data packets examines layer 2 of the OSI model and the base portion of network communication: Ethernet. In some regards, Ethernet is the most important of all the enclosed packets, in that it needs to pass muster at the data link level where it operates to further communication.

Figure 1 illustrates the Ethernet data packet architecture that nodes use to transmit their data onto the network, consisting of five sections. The first one, the preamble, contains the packet timing frame, which includes 7 bytes, or 56 bits, of alternating 1s and 0s. Ethernet uses asynchronous serial communication, so there is no separate clock signal. Instead, the clock is modulated into the data using a type of Manchester encoding. The idea of the timing frame is to help the receiver’s clock get in sync with the incoming data packet. At the end of the preamble is the start frame deliminator (SFD), which always consists of 8 bits of alternating 1s and 0s ending with 11. The 11 indicates to the recipient that the preamble has ended and the packet information is about to start.

Figure 1. The Basic Ethernet Packet Architecture

Figure 1. The Basic Ethernet Packet Architecture

The first part of the packet information is the Ethernet addressing. Ethernet addresses include 6 bytes of information. Each byte is written in hexadecimal format and delimitated by a colon. The destination address comes first, identifying the intended recipient. The second address is the source address, indicating which node sent it. In the example shown here, the destination address of the intended recipient is 00:00:A1:FD:23:C9, followed by the sender or source address, 00:00:A1:1E:04:12.

Reading the source address helps bridges and switches learn which packets are on each of their ports. Knowing who’s on which port helps them identify whether to “lower the bridge” and let the packet through or block it from moving forward. Segmenting packets in this way helps eliminate unnecessary traffic.

Following the addressing section is a two-byte field called length that specifies how much data the packet is carrying. The data payload can range from 46 to 1,522 bytes in length. As we’ll see, this capacity eventually does not leave a lot of room for the data payload as the packets move up the OSI model. For all the information to fit, there will need to be many packets breaking the data down into smaller packages.

Finally, at the end of the packet is a 4-byte checksum called the cyclic redundancy check (CRC), which helps detect errors introduced during transmission or storage. The CRC adds up all the 1s and 0s of the packet field 4 bytes at a time to generate a checksum.

To receive a data packet, the Ethernet circuitry first syncs with the incoming timing frame. Next, if the Ethernet recognizes the packet’s destination address as its own, it runs a checksum on the packet to compare with the checksum sent. That tells the Ethernet recipient if the packet arrived intact. If the packet got scrambled or corrupted along the way, the checksums won’t match, and the Ethernet circuitry will simply throw the packet away into the proverbial bit bucket. If the destination address doesn’t match the Ethernet address, it also will toss the packet. Some protocol further up the chain will worry about packets arriving.

But if the data packet has its Ethernet address as its destination, and if the checksums jive, the Ethernet will accept the packet. If the packet is correctly addressed, it will then check the source address to see who sent it. Then, it will check the payload to see how much data there is, extract it, and forward it upstream to the OSI model layers.

When we speak of serial communication here—sending data one bit at a time, as opposed to all at once—we’re usually talking about using 10BASE-T, or twisted pair cabling. Twisted pair has a maximum limit of 100m (328 feet). There is also 10BASE-F, which is fiber optics cabling. Fiber optics cabling can be up to a kilometer in length, but it is still a point-to-point connection like twisted pair. Now if I want to connect across town, I can use a couple of repeaters and a couple of kilometers (or about one and a quarter miles) of fiber optic cable. Now we’re going places!

Jeff Kabachinski is a healthcare IT pundit and technical strategist in Davidson, NC. For more information, contact chief editor Jenny Lower at

Photo credit: © Ruslanbosikov |