Ethernet Frames and MAC Addresses: Envelopes on the Wire

0s14★ 40 XP

Lesson 9Interactive lesson

Ethernet Frames and MAC Addresses: Envelopes on the Wire

A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.

Lesson format17 sections1 code block2 practice itemsUpdated Oct 2, 2026

New PC plugged into office switch can't reach anyone. Link light is green. You check: PC has no IP, but switch already saw its MAC. Link works, IP missing. Frame vs packet matters — MAC got there, IP didn't. That's this lesson.

Think of an Ethernet frame as an office envelope. Outside: TO (destination MAC), FROM (source MAC), TYPE (what's inside: IPv4? IPv6?). Inside: your data. Back flap: checksum (FCS) so receiver knows envelope wasn't damaged. Switches only read the outside. They never open the letter.

#The Frame, Without Memorization Pain#link

Part	Size	Job
Destination MAC	6 bytes	Who should read it
Source MAC	6 bytes	Who sent it, so switch can learn
Type	2 bytes	0x0800 = IPv4, 0x86DD = IPv6 inside
Data	46-1500 bytes	Your packet (IP + TCP + app)
FCS	4 bytes	Checksum, drop if damaged

Max data 1500 bytes = MTU you will hear forever. Preamble/SFD before the frame are just clock sync, not counted. Tagged VLAN frames add 4 bytes — full detail in Module 6, just know tagged is slightly bigger.

#Your MAC: Read It Now#link

Inspect your own MAC on Linux

root@vulnarex:~#ip link show eth0

link/ether is your MAC, 48 bits as 6 hex pairs. brd ff:ff:ff:ff:ff:ff is broadcast — 'everyone on my LAN'. First half of a real NIC is vendor OUI, second half unique. Addresses starting 02:... like above are locally assigned (VMs/containers) — normal in labs.

▪Unicast: one receiver, e.g. 00:1A:2B:11:22:33 — first bit of first byte = 0
▪Broadcast: everyone, always ff:ff:ff:ff:ff:ff — ARP uses this to ask 'who has this IP?'
▪Multicast: a group, e.g. 01:00:5E:... — one sender, many interested receivers

★ 10 XP

SYNTAX VALIDATION (★ 10 XP)

On lab-ws run: ip link show eth0, write your MAC and MTU. Then run: ip neigh show — every entry is a MAC your machine learned on this LAN. Ping 10.10.20.1 then re-run ip neigh: a new/REACHABLE entry appears. That's learning in action.

root@vulnarex:~#

Press Enter to submit

#Frame Inspection Exercise#link

★ 15 XPmedium

callout

Deferred for later: 1522-byte tagged math, 802.1Q details (Module 6), STP BPDU MAC 01:80:C2... (Module 7), HSRP virtual MACs (Module 14). You don't need them to understand forwarding.

#Quick Check#link

★ 15 XPeasy

quiz BLOCK (★ 15 XP)

PC sends to unknown server on same LAN. Switch has no entry for server MAC. What does the switch do?

Select your proof vectors above

Know envelope parts, read your MAC, and unicast vs broadcast cold. Next: how the switch remembers every MAC it sees.

tip

Optional: capture in Wireshark, filter eth.dst == ff:ff:ff:ff:ff:ff to see ARP broadcasts live. One capture teaches more than diagrams.

Lesson completion

Ready to resolve this lesson?

Finish the lesson once you have worked through the material. This awards ★ 40 XP.

Previous lesson

Lesson tools

Workspace

0% read

Lab notes

Notes persist per lesson.

The Frame, Without Memorization Pain Your MAC: Read It Now Frame Inspection Exercise Quick Check

Content

Last updated

October 2, 2026

Agent Setup

Access lesson content programmatically for AI agents, LLMs, and automated pipelines.

Fetch as Markdown (Accept header)

curl -H "Accept: text/markdown" "https://vulnarex.com/api/content/lessons?courseSlug=complete-ccna-200-301&lessonSlug=1-ethernet-frames-mac-addresses&lang=en&format=markdown"

MCP Server Config (mcp.json)

{
  "mcpServers": {
    "vulnarex": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-fetch"],
      "env": { "MCP_FETCH_URL": "https://vulnarex.com" }
    }
  }
}

MCP Server Card/.well-known/mcp.json A2A Agent Card/.well-known/agent-card.json API Catalog/.well-known/api-catalog robots.txt/robots.txt

Laboratory sanity code

Isolate active probes on matched virtual networks and keep execution streams sandboxed.

Part

Size

Job

Destination MAC

6 bytes

Who should read it

Source MAC

6 bytes

Who sent it, so switch can learn

Type

2 bytes

0x0800 = IPv4, 0x86DD = IPv6 inside

Data

46-1500 bytes

Your packet (IP + TCP + app)

FCS

4 bytes

Checksum, drop if damaged

Ethernet Frames and MAC Addresses: Envelopes on the Wire

#The Frame, Without Memorization Pain#link

#Your MAC: Read It Now#link

On lab-ws run: ip link show eth0, write your MAC and MTU. Then run: ip neigh show — every entry is a MAC your machine learned on this LAN. Ping 10.10.20.1 then re-run ip neigh: a new/REACHABLE entry appears. That's learning in action.

#Frame Inspection Exercise#link

#Quick Check#link

PC sends to unknown server on same LAN. Switch has no entry for server MAC. What does the switch do?

Ready to resolve this lesson?

Ethernet Frames and MAC Addresses: Envelopes on the Wire

#The Frame, Without Memorization Pain#link

#Your MAC: Read It Now#link

On lab-ws run: ip link show eth0, write your MAC and MTU. Then run: ip neigh show — every entry is a MAC your machine learned on this LAN. Ping 10.10.20.1 then re-run ip neigh: a new/REACHABLE entry appears. That's learning in action.

#Frame Inspection Exercise#link

Classify each destination MAC

#Quick Check#link

PC sends to unknown server on same LAN. Switch has no entry for server MAC. What does the switch do?

Ready to resolve this lesson?

Classify each destination MAC