802.3 · LAN

The Ethernet frame where it starts and where it stops

Everybody knows the numbers 64 and 1518. Almost nobody can say from where to where they are counted — and that is the whole plate. Drag the payload and watch three different totals move: the frame, the packet, and what the wire actually spends.

Sequence diagram poster of the WPA2 4-way handshake

Requesting scene from the content service…

64–1518

dst address → FCS, inclusive

84 B

what a minimum frame costs the wire

1536

the Length/Type threshold, not 1500

frame vs packet (802.3as)slot time as the 64-byte floorthe 35-value dead zone802.1Q: +4 bytes, ceiling 1522

What you'll learn

Where the frame really begins and ends: IEEE 802.3 clause 3.1 measures from the destination address field through the frame check sequence, inclusive — the preamble and the SFD are outside it.
Why the standard itself renamed things: 802.3as called preamble + SFD + frame a packet, which is why the gap between frames became the Inter-Packet Gap.
Why a 64-byte frame costs 84 bytes of wire, and why that is the ceiling on small-packet throughput.
Where the 64-byte minimum comes from: it is the slot time expressed in octets — a half-duplex parameter — so that a sender cannot finish transmitting before the evidence of a collision gets back to it. Full duplex removed the mechanism and kept the floor.
That the Length/Type threshold is 1536, not 1500 — and that between 1501 and 1535 there is a real gap of thirty-five values that are neither a length nor a type.
What the 802.1Q tag does and does not move: the ceiling goes to 1522 and the floor stays at 64 — and the tag is not the only thing that moves a ceiling, because 802.3as added a third one, the 2000-byte envelope frame.
What the FCS covers: destination, source, the 802.1Q tag when there is one, length/type, data and pad — but never the preamble, the SFD or itself.

The boundary nobody draws

Ask where an Ethernet frame starts and most answers begin at the preamble. The standard disagrees, and says so in a single sentence. IEEE 802.3 clause 3.1: "The minimum and maximum frame size limits in 4.4 refer to that portion of the frame from the destination address field through the frame check sequence field, inclusive." The seven bytes of preamble and the one byte of start-of-frame delimiter run ahead of that span, and the twelve-byte gap follows it. None of them are counted in 64 or in 1518.

The standard eventually admitted the confusion was its own. 802.3as gave the larger thing a name — preamble plus SFD plus frame is a packet — and the interframe gap became the inter-packet gap to match. So there are two legitimate totals with two legitimate names, and a third, larger still, if you also count the silence the wire has to leave afterwards. When two people disagree about the size of an Ethernet frame, they are usually each measuring a different one of the three.

Where 64 comes from, and what it costs

The 64-byte minimum is not a property of data. It is the slot time expressed in octets — and the slot time is a half-duplex parameter, which the standard does not equate to anything: it requires it to be larger than the sum of the physical layer round-trip propagation time and the maximum jam time. A frame shorter than that floor would finish transmitting before the evidence of a collision could travel back, and the sender would never learn it had collided. That is why a card that has only a few bytes to send pads the frame with filler until it reaches 64. The padding is not discretionary: the MAC must pad, by a fixed rule, after the client's data and before the FCS is computed — which is why the FCS covers the pad, and why only its contents are left unspecified.

The consequence is arithmetic anybody sizing a link should carry. A minimum frame occupies 84 bytes of the medium: eight in front, sixty-four of frame, twelve of gap. Budget 64 and the wire spends 31 percent more than your estimate says, and that is the real ceiling on small-packet throughput. At the other end of the ruler the eighteen bytes of header and FCS sit on 1500 bytes of payload and cost 1.2 percent — which is why bulk transfers approach line rate and floods of tiny frames do not. Speed did not change the floor: at 1 Gb/s the slot time rose to 4096 bit times and half-duplex senders fill the difference with carrier extension outside the FCS, and at 10 Gb/s there is no slot time at all because there is no half duplex — no collision mechanism is left to justify the floor, and the floor is still 64.

The threshold is 1536, and there is a hole

The two bytes after the addresses mean one of two mutually exclusive things: a length, or a type. The dividing line is not where most diagrams put it. At 1500 (0x05DC) and below the field is a length; at 1536 (0x0600) and above it is a type. Between them, from 0x05DD to 0x05FF, is a gap of thirty-five values that neither reading reaches. The standard does not declare them unassigned; it sets both bounds and leaves what falls between them out of reach. It is a real hole, not a rounding of the drawing.

Which side of the line a frame sits on has a practical cost. A length means the frame is carrying LLC, and LLC/SNAP prepends eight more bytes of header, leaving 1492 bytes for your data instead of 1500. Today the type reading is the default: RFC 1122 §2.3.3 requires support for RFC 894 and states that an implementation of both must default to RFC-894. The plate draws the threshold as a window from 1480 to 1560, because at full scale the thirty-five-value gap would be half a pixel wide.

← Previous plate

Wi-Fi 7 deep-dive · MLO · 320 MHz · 4096-QAM

Next plate →

The MAC address · the first bit onto the wire

Atlas index