Ethernet Frame Format: The Complete Structure

Before a single byte of user data traverses an Ethernet network, a fundamental challenge must be addressed: How does the receiving device know when a frame begins?

In the electrical realm of networks, the physical medium carries nothing more than voltage fluctuations—a continuous stream of energy states that the receiver must interpret as meaningful binary data. Without explicit synchronization, the receiver cannot distinguish the start of a new frame from idle line noise, mid-transmission data, or the end of a previous frame.

This is the problem that the Preamble and Start Frame Delimiter (SFD) were designed to solve—and their elegant solution has remained essentially unchanged since Ethernet's invention in the 1970s.

To understand the Preamble and SFD, we must first appreciate the physical layer environment in which they operate. Ethernet frames do not simply appear fully-formed at the receiver—they must be reconstructed from raw electrical or optical signals.

The Signal Recovery Problem

When an Ethernet transmitter sends data, it converts binary bits into physical signals—voltage levels on copper wire, or light pulses on optical fiber. The receiver must perform the inverse operation: observe physical signals and recover the original bit stream.

This process is complicated by several factors:

The Role of the Preamble

The Preamble addresses these challenges by providing a known, predictable bit pattern that the receiver can use to:

1. Lock onto the signal — Detect that a transmission is occurring (as opposed to idle line state)
2. Synchronize the clock — Align the receiver's sampling clock to the transmitter's bit rate
3. Set the decision threshold — Calibrate voltage levels for distinguishing 1s from 0s
4. Stabilize the receive circuitry — Allow automatic gain control (AGC) and equalizers to settle

Without these preparatory bits, the receiver would attempt to interpret actual data before its clock recovery circuits had stabilized, resulting in random bit errors at the start of every frame.

The Ethernet Preamble consists of exactly 7 bytes (56 bits) in a specific, carefully chosen pattern:

10101010 10101010 10101010 10101010 10101010 10101010 10101010

Each byte has the hexadecimal value 0xAA. But why this particular pattern?

The Alternating Bit Pattern

The alternating 1-0-1-0 pattern is not arbitrary—it is the optimal waveform for clock recovery. When transmitted using Manchester encoding (used in 10 Mbps Ethernet), this pattern produces a continuous sequence of transitions at the maximum possible rate:

• Every bit period contains exactly one transition
• The waveform appears as a perfect square wave at the bit clock frequency
• Phase-locked loop (PLL) circuits can lock onto this predictable frequency almost immediately

No other bit pattern provides as many regular transitions per unit time. A sequence of all 1s or all 0s would produce no transitions at all (after the initial edge), making clock recovery impossible.

Why Exactly 7 Bytes?

The 56-bit Preamble length was determined empirically by Ethernet's designers at Xerox PARC in the 1970s. The length provides sufficient time for:

1. PLL acquisition — Typically 10-20 bit periods for a well-designed PLL to lock
2. AGC settling — Automatic Gain Control needs ~20-30 bit periods to stabilize gain
3. Equalizer convergence — Adaptive equalizers require additional settling time
4. Safety margin — Extra bits ensure reliable operation across component variations

Modern Ethernet receivers can lock much faster than 1970s hardware, but the Preamble length remains at 7 bytes for backward compatibility and to account for worst-case scenarios.

The Preamble's effectiveness is intimately tied to the line coding scheme used. In original 10 Mbps Ethernet, Manchester encoding was employed, which embeds the clock signal within the data stream.

How Manchester Encoding Works

In Manchester encoding, each bit period is divided into two halves, and the bit value is encoded as a transition at the midpoint:

• Binary 0: High-to-low transition at mid-bit (↓)
• Binary 1: Low-to-high transition at mid-bit (↑)

This guarantees at least one transition per bit, regardless of the data pattern, ensuring that clock information is always present in the signal.

Preamble in Manchester Encoding

When the alternating 10101010 Preamble pattern is transmitted using Manchester encoding, the result is a sequence of transitions at every bit boundary AND every mid-bit point. The waveform has the maximum transition density possible:

Bit:         1    0    1    0    1    0    1    0
            ┌──┐ ┌──┐ ┌──┐ ┌──┐ ┌──┐ ┌──┐ ┌──┐ ┌──┐
Manchester: ┘  └─┘  └─┘  └─┘  └─┘  └─┘  └─┘  └─┘  └─
            ↑  ↓ ↑  ↓ ↑  ↓ ↑  ↓ ↑  ↓ ↑  ↓ ↑  ↓ ↑  ↓

This creates a steady 10 MHz square wave for 10 Mbps Ethernet (two transitions per 100ns bit period). The receiver's phase-locked loop sees this as a pure frequency reference and can rapidly lock onto the precise bit timing.

The Clock Recovery Circuit

A simplified clock recovery circuit for Manchester-encoded Ethernet consists of:

1. Edge Detector — Identifies all signal transitions
2. Phase-Locked Loop (PLL) — Generates a local clock synchronized to incoming transitions
3. Voltage-Controlled Oscillator (VCO) — Adjusts frequency based on phase error
4. Phase Comparator — Measures difference between local clock and incoming edges
5. Loop Filter — Smooths adjustments to prevent oscillation

During the Preamble, the PLL has 56 bit periods of perfect reference signal to achieve lock. By the time actual frame data arrives (which may have fewer transitions), the clock is solidly synchronized.

Following the 7-byte Preamble, a single byte marks the transition from synchronization to actual frame content. This is the Start Frame Delimiter (SFD), defined as:

10101011 (binary) = 0xAB (hexadecimal)

Distinguishing SFD from Preamble

The SFD is almost identical to the Preamble bytes—six of its eight bits are the same alternating pattern. Only the final two bits differ:

• Preamble byte: 10101010 (ends with '10')
• SFD byte: 10101011 (ends with '11')

This subtle change—two consecutive '1' bits at the end—creates a distinctive pattern that the receiver can detect to identify the exact byte boundary where frame content begins.

Why Two Consecutive 1s?

The choice of ending the SFD with '11' rather than continuing the '10' pattern is significant:

1. Unique Pattern — In the alternating Preamble sequence, two consecutive identical bits never occur. The '11' ending is therefore unambiguous.

2. Easy Detection — Hardware can detect the SFD by watching for the first occurrence of two same-polarity transitions in a row after the Preamble begins.

3. Single-Bit Uniqueness — Even if one Preamble bit is corrupted, the '11' pattern still stands out from the predominant '10' alternation.

4. Minimal Change — Changing only the last bit maintains maximum clock recovery performance throughout most of the Preamble+SFD sequence.

Frame Content Alignment

The SFD serves as the zero-reference point for frame content. Once the receiver detects the SFD pattern, it knows that:

• The next bit begins the Destination MAC address field
• All subsequent byte boundaries can be determined by counting bits from this point
• Any bit timing uncertainties from clock acquisition are behind us

The SFD essentially tells the receiver: "Synchronization is complete. Real data starts now."

In the IEEE 802.3 standard, the Preamble and SFD are sometimes described as a combined 8-byte (64-bit) unit at the beginning of each frame:

Bytes 1-7:  10101010 10101010 10101010 10101010 10101010 10101010 10101010
Byte 8:     10101011 (SFD)

However, it's important to understand the layering:

• DIX Ethernet (Ethernet II): Originally defined a 8-byte Preamble that included what we now call the SFD
• IEEE 802.3: Separated the Preamble (7 bytes) from the SFD (1 byte) for clearer definition

Both specifications describe the same bit sequence—the difference is purely definitional.

Relationship to Frame Size Calculations

When calculating Ethernet frame sizes, it's crucial to understand what is and isn't counted:

The Preamble and SFD are considered Physical Layer overhead—they are transmitted on the wire but are not part of the MAC frame proper. Network analyzers typically do not display the Preamble/SFD because it is stripped by the receiving NIC before the frame reaches software.

Similarly, the 64-byte minimum frame size and 1518-byte maximum frame size (excluding VLANs) do not include the Preamble and SFD.

As Ethernet evolved from 10 Mbps to 100 Gbps and beyond, the physical layer encoding changed dramatically. Manchester encoding gave way to more efficient schemes that pack more bits per symbol. Yet the Preamble and SFD concepts persist—adapted to each new physical layer.

10 Mbps Ethernet (10BASE-T, 10BASE5, 10BASE2)

• Uses Manchester encoding
• Preamble: 56 bits of alternating 1-0 pattern
• SFD: 8-bit pattern 10101011
• Purpose: Direct clock recovery from bit transitions

100 Mbps Fast Ethernet (100BASE-TX)

• Uses 4B/5B encoding with MLT-3 signaling
• Preamble: Mapped to equivalent synchronization symbols
• The 4B/5B code ensures sufficient transitions for clock recovery
• Idle symbols (/I/) and Start-of-Stream (/J/K/) delimiters replace raw Preamble/SFD

1 Gbps Ethernet (1000BASE-T, 1000BASE-X)

• Uses 8B/10B encoding (fiber) or PAM-5 (copper)
• Start-of-Packet Delimiter (SPD) replaces traditional SFD
• /S/ ordered set marks frame start
• Clock recovery handled by continuous idle pattern between frames

The Consistent Principle

Despite the changing terminology and encoding schemes, the underlying principle remains constant:

1. Establish synchronization before transmitting user data
2. Mark frame boundaries unambiguously
3. Provide clock reference for bit/symbol recovery

Higher-speed Ethernets simply implement these functions with more sophisticated signaling schemes optimized for greater bandwidth efficiency. The 10 Mbps Preamble used 8 bytes out of a minimum 72-byte transmission (11% overhead). Modern encoding schemes reduce this overhead significantly while maintaining reliability.

Understanding the Preamble and SFD has several practical implications for network design, troubleshooting, and performance analysis.

Bandwidth Overhead Calculation

The Preamble and SFD add 8 bytes to every frame transmitted. Combined with the 12-byte Inter-Packet Gap (IPG), every frame carries 20 bytes of physical layer overhead regardless of size:

• Minimum frame (64 bytes MAC): 64 + 8 + 12 = 84 bytes on wire
• Maximum frame (1518 bytes MAC): 1518 + 8 + 12 = 1538 bytes on wire
• Jumbo frame (9000 bytes MAC): 9000 + 8 + 12 = 9020 bytes on wire

For small packets (VoIP, gaming, acknowledgments), this overhead is significant. A 64-byte frame has 24% physical layer overhead (20/84).

The Preamble and Start Frame Delimiter represent the critical bridge between the physical layer's analog signal processing and the data link layer's digital frame processing. Let's consolidate what we've learned:

What's Next

With synchronization established and the frame boundary identified, the receiver is ready to process actual frame content. The next page examines the Destination and Source MAC Address fields—the addressing mechanism that enables directed communication within local area networks.