Chapter 3 - Ethernet Frame Format Notes

Most Significant Bit (MSB) - Also known as the high order bit. These are the left-most bit, or bits. A great example that the book uses is that in a PS-Poll frame, the Duration/ID field carries either the Duration, or the AID (association identifier.) If the MSB's are set to 11 then the following bits represent the AID. If the single MSB is set to 0 then the following bits will be the duration of the frame.

Least Significant Bit (LSB) - This is the right most bit since its (normally) going to be in the furthest right position. Fun factoid the book points out that I never realized in my years of binary. This is the bit that determines if the value will be even or odd… don't know how I never realized that before.

Most Significant Bit First (MSBF) - Pretty straightforward, when receiving the MSB will come in first and the LSB will be last.

Least Significant Bit First (LSBF) - The opposite of MSBF with the least significant bit coming in first. Which is what 802.11 and 802.3 use

Octet - 8-bit Byte

In an octet the least significant is denoted as b0 and the MSB is denoted as b7

802.3 frame diagram

Carpenter, Tom. CWAP: Certified Wireless Analysis Professional: Official study guide: Edition CWAP-402. Certitrek Publishing, 2016.

Preamble - Just because a frame is getting sent on the wire doesn’t mean that it doesn’t need a preamble. This is to alert the receiving device that a frame is incoming and to synchronize it so that the timing is… well, synchronized. The ethernet preamble is 7 repeating octets of 10101010 - This is how they would be received, which, remember is Least Significant Bit First, so the first bit is actually the left-most bit.

SFD - The SFD comes right after the Preamble is a single octet that’s 10101011. The pattern might look vaguely similar, and its because its basically the same as the preamble pattern, only with its MSB being a 1 rather than a 0. This 11 pattern rather than the preambles 10, tells the receiver that the MAC frame is incoming.

Destination Address (DA) and Source Address (SA) -  These are the MAC addresses of the receiver and the transmitter respectively. You'll notice that above it says that the are 6 octets (48-bits) a piece. Which would make sense since MAC addresses are 48-bits long. However!!! Did you know that really only 46 of those bits are unique? The remaining two are for I/G (individual address or group address) and for U/L (globally administered address or locally administered address)

• These bits are the two LSB's in the first octet of the MAC address (U/L = b1 and I/G = b0). So when you are looking at a MAC address they are the two right most bits in the first octet which his in the OUI section.
• Broadcast address consists of the 46-bit address being made up of all ones.

By Inductiveload, modified/corrected by Kju - SVG drawing based on PNG uploaded by User:Vtraveller. This can be found on Wikipedia here., CC BY-SA 2.5-2.0-1.0, https://commons.wikimedia.org/w/index.php?curid=1852032

Type/Length Field - Nowadays this is mostly used to dictate the type of client protocol, however it could also specify the length of the MAC Client Data. The most commonly used ethertypes are IPv4, ARP, LLDP, and EAP over LAN

Data Field - This is the actual payload from the upper layers. The maximum payload size is 1500 bytes, however you will see 1518 bytes noted, but this is including the DA/SA, Length/Type, and FCS fields, which all add up to 18 bytes.

FCS - This is used to check the integrity of the frame. It contains a cyclic redundancy check value. Its important to note that the CRC bits in the FCS field (say that 5 times fast) are actually transmitted with the MSB first. Which is different from the rest of the ethernet frame which is transmitted with the LSB first and ending with the MSB.

Extension - This field is used when the frame would be less than a full slot time in the PHY being used. Essentially it adds padding to ensure that a frame fills a slot time.