8.1 Ethernet frame, MAC address, and Neighbor Resolution

The data link layer handles frames, MAC addresses, and switching on the current link. In a typical IPv4 LAN, ARP resolves a next-hop IP address to a link-layer MAC address. After the packet leaves that link, the next hop uses a new link-layer header.

The data link layer encapsulates network-layer packets into frames suitable for transmission over the specific link. It is not synonymous with the physical layer: concerns such as copper signaling, optical modulation, radio channels, and bit timing belong to the physical layer, while framing, link-local addressing, and error detection belong to the data link layer. Replacing a cable and inspecting a MAC table address different kinds of failure.

1. The Counting Boundary of Ethernet II Frames

| Destination | Source | Type | Payload + padding | FCS |
|    6 B      |  6 B   | 2 B  |    46–1500 B    | 4 B |

For standard untagged Ethernet frames, the total size from Destination address to FCS typically ranges from 64 to 1518 bytes. The preamble (7 bytes) and Start Frame Delimiter (1 byte) are used for physical/MAC layer synchronization and are not included in this 64–1518-byte frame size. The interpacket gap is also not part of the frame field.

Field	Purpose
Destination	The destination MAC address, which can be unicast, multicast, or broadcast
Source	The sender's MAC address; it should not be a multicast address
EtherType	Identifies the protocol of the payload, such as IPv4 0x0800, ARP 0x0806, or IPv6 0x86DD
Payload/pad	The network-layer packet; if too short, padding is added to meet the minimum frame size
FCS	The receiver checks the CRC and normally discards frames that fail; it does not provide retransmission

Values up to 1500 in this two-byte field indicate length; values from 1536 (0x0600) indicate EtherType. The gap, 1501–1535, belongs to neither valid range. Captures usually omit preamble/SFD, and NICs or drivers often strip FCS. A 60-byte capture plus the four-byte wire FCS gives a valid minimum 64-byte frame. Do not add preamble/SFD to a size definition that already excludes them. Check the capture link type and truncation length too.

The 64-byte minimum originates from the collision detection constraints of classic shared-medium half-duplex Ethernet. Modern switched full-duplex Ethernet does not use CSMA/CD to detect collisions, yet frame format compatibility preserves the minimum frame size.

2. MAC address is not a physical location

A common Ethernet MAC address is 48 bits long, for example 02:00:5e:10:00:01. The first octet contains two important bits:

• I/G is the least significant bit (mask 0x01): 0 means individual/unicast, 1 means group/multicast;
• U/L is the next least significant bit (mask 0x02): 0 means universal administration, 1 means local administration.

The first octet 02 therefore marks a locally administered unicast address. The prefix alone cannot establish which device is using it.

ff:ff:ff:ff:ff:ff is the broadcast address. Universally administered addresses can have their prefix assigned by an IEEE registration authority, but this does not mean every MAC address is factory-burnt, globally unique, or permanently immutable. Operating systems can configure locally administered addresses. Wi-Fi clients often randomize addresses, and virtual interfaces, containers, and VMs can generate them too.

A MAC address is a link-layer forwarding identifier, not a trustworthy identity, geographic location, or Internet-wide route locator. It can be spoofed or duplicated across broadcast domains. A router builds new source/destination MAC headers for the next Ethernet link; ordinary Layer 2 switching normally preserves these addresses.

3. Who receives it: first route lookup, then neighbor lookup

When a host wants to send a packet to a destination IP address, it does not immediately perform an ARP request for that destination. Instead, it first consults the route table to determine:

1. the outgoing interface;
2. the next-hop IP address;
3. the source address and other route attributes.

If the destination lies within a directly connected network prefix, the next hop is typically the destination itself. If the destination is on a remote network, the next hop is the gateway or router. Neighbor resolution resolves the link-layer address of the next hop. Therefore, when a host accesses an Internet server, it usually looks up the gateway's MAC address on the local Ethernet segment, not the remote server's MAC address.

# Linux: inspect the kernel route decision for a destination
ip route get 203.0.113.10

# Check neighbor table
ip neigh show

4. IPv4 ARP

ARP maps an IPv4 protocol address to a link-layer address within the same link/broadcast domain. A typical exchange looks like this:

Host A broadcasts:
  Who has 192.0.2.1? Tell 192.0.2.10

The owner of 192.0.2.1 usually responds unicast:
  192.0.2.1 is at 02:00:5e:00:53:01

An initial request for an unknown MAC normally uses Ethernet broadcast. The ARP target hardware address is unknown and commonly zero; it is a separate field from the outer broadcast destination MAC. Replies are normally unicast. Validation of an existing cache entry may also use a unicast ARP request. The host stores the mapping in its neighbor table, but cache lifetime and state behavior vary by OS. Do not hardcode a universal 120-second lifetime. Linux displays neighbor states such as INCOMPLETE, REACHABLE, STALE, DELAY, PROBE, and FAILED.

RFC 5227 distinguishes probes from announcements. An ARP Probe uses sender IP 0.0.0.0 and the candidate address as target IP; an ARP Announcement uses the adopted address in both fields to announce it and assist conflict handling. Failover often uses gratuitous ARP to update mappings, but acceptance depends on OS and security configuration. An unauthenticated ARP message cannot prove a host’s identity simply by introducing itself.

5. IPv6 Does Not Use ARP

IPv6 uses ICMPv6 Neighbor Discovery (NDP) to perform address resolution, router discovery, prefix discovery, and neighbor reachability detection. Address-resolution Neighbor Solicitations use solicited-node multicast; reachability probes for a known neighbor may instead use unicast NS. IPv6 does not use Ethernet broadcast ARP.

NDP relies on ICMPv6. Blocking all ICMPv6 traffic will break fundamental IPv6 functions such as neighbor discovery and Path MTU Discovery. Security design should filter ICMPv6 messages based on type/code and rate policies, rather than assuming an ICMP ban is safer.

6. An Ethernet II Parser That Does Not Forge FCS

Packet captures often provide only the bytes from Destination to the start of the FCS, with the FCS itself stripped away. This parser accepts untagged Ethernet II data with the FCS stripped. It does not guess the capture format or infer padding from trailing zeros:

from dataclasses import dataclass
import struct

@dataclass(frozen=True)
class EthernetII:
    destination: str
    source: str
    ethertype: int
    payload_and_padding: bytes

def format_mac(raw: bytes) -> str:
    return ":".join(f"{octet:02x}" for octet in raw)

def parse_ethernet_ii(raw: bytes) -> EthernetII:
    if len(raw) < 14:
        raise ValueError("capture is shorter than an Ethernet II header")
    destination = format_mac(raw[0:6])
    source = format_mac(raw[6:12])
    ethertype = struct.unpack("!H", raw[12:14])[0]
    if ethertype < 0x0600:
        raise ValueError("not a valid EtherType for this parser")
    if ethertype in (0x8100, 0x88A8):
        raise ValueError("VLAN-tagged frames need a tag-aware parser")
    return EthernetII(destination, source, ethertype, raw[14:])

sample = bytes.fromhex(
    "ffffffffffff"          # Ethernet destination
    "02005e100001"          # Ethernet source
    "0806"                  # ARP EtherType
    "0001080006040001"      # Ethernet/IPv4, address lengths, ARP request
    "02005e100001c000020a"  # sender MAC, 192.0.2.10
    "000000000000c0000201"  # unknown target MAC, 192.0.2.1
) + bytes(18)              # pad 28-byte ARP payload to 46 bytes
assert len(sample) == 60   # 64 bytes on wire once the FCS is included
frame = parse_ethernet_ii(sample)
assert frame.destination == "ff:ff:ff:ff:ff:ff"
assert frame.ethertype == 0x0806
print(frame)

The sample contains a complete ARP request and padding, without FCS. The parser only splits the header: it does not validate every EtherType’s payload, maximum frame size, or address validity. Successful parsing is not wire validation. It preserves padding because zero bytes may be valid payload too. Recognized VLAN tags are rejected explicitly; the next lesson explains their layout.

7. Acceptance Questions

1. Why does a 60-byte packet capture not necessarily violate the 64-byte minimum frame size on the wire?
2. Differentiate between the I/G and U/L bits in a MAC address.
3. Host 192.0.2.10/24 accesses 198.51.100.8, with a default gateway at 192.0.2.1: who should be the ARP target?
4. Why can't a MAC address serve as an authentication identity?
5. List two additional responsibilities of IPv6 NDP compared to IPv4 ARP.

Next lesson: 8.2 Ethernet Switching, VLANs, and Loop Protection.

References

• RFC 826: An Ethernet Address Resolution Protocol
• RFC 5227: IPv4 Address Conflict Detection
• RFC 4861: Neighbor Discovery for IPv6
• IEEE Registration Authority: MAC