Ethernet

• Preamble (7 bytes) — An alternating pattern of 10101010 repeated 7 times. Allows the receiving NIC's clock to synchronize with the sender's bit timing. Not part of the frame proper — it's a physical-layer artifact.
• SFD — Start Frame Delimiter (1 byte) — The pattern 10101011. The final 11 signals "the real frame starts now." Together with the preamble, that's 8 bytes of synchronization overhead.
• Destination MAC (6 bytes) — The intended recipient. Can be unicast (one host), multicast (group), or broadcast (FF:FF:FF:FF:FF:FF).
• Source MAC (6 bytes) — The sender's hardware address. Always unicast — a broadcast source makes no sense.
• EtherType / Length (2 bytes) — If the value is ≥ 0x0600 (1536), it's an EtherType identifying the upper-layer protocol. If ≤ 0x05DC (1500), it's a length field (IEEE 802.3 format). In practice, you'll almost always see EtherType values.
• Payload (46–1500 bytes) — The encapsulated data (typically an IP packet). Minimum 46 bytes — if the actual data is shorter, the frame is padded to meet the minimum frame size of 64 bytes (required for collision detection in half-duplex Ethernet).
• FCS — Frame Check Sequence (4 bytes) — A CRC-32 checksum computed over the destination MAC, source MAC, EtherType, and payload. The receiver recalculates and silently drops frames with mismatched FCS. No retransmission at Layer 2 — that's TCP's job.

Wire vs. Wireshark: You won't see the Preamble, SFD, or FCS in a typical Wireshark capture. The NIC strips those before handing the frame to the OS. What Wireshark shows you is the 14-byte header (Dest MAC + Src MAC + EtherType) plus the payload. Keep this in mind when calculating frame sizes on the wire vs. in captures.

• OUI (Organizationally Unique Identifier) — Assigned by IEEE to manufacturers. The first 3 bytes identify the vendor. Example: 00:50:56 = VMware, DC:A6:32 = Raspberry Pi.
• Device ID — Assigned by the manufacturer to uniquely identify each NIC within that OUI.
• Notation — Written as six hex pairs. Colon-separated AA:BB:CC:DD:EE:FF (Linux/Wireshark), dash-separated AA-BB-CC-DD-EE-FF (Windows), or dot-separated AABB.CCDD.EEFF (Cisco).

Wireshark filter tip: Use eth.type == 0x0806 to isolate ARP traffic, or eth.type == 0x8100 to find VLAN-tagged frames on a trunk port mirror.

• IP fragmentation — When an IP packet exceeds the link MTU, the router fragments it. Fragmentation is CPU-intensive, causes reassembly overhead at the destination, and a single lost fragment means retransmitting the entire original packet.
• Don't Fragment (DF) bit — Most modern stacks set the DF bit in the IP header. With DF set, an oversized packet is dropped (not fragmented) and the router sends an ICMP "Fragmentation Needed" message. This is the basis of Path MTU Discovery (PMTUD).
• Overlay overhead — VXLAN adds 50 bytes, Geneve adds 50+ bytes, GRE adds 24+ bytes. If the underlay MTU is 1500, your overlay effective MTU is ~1450. Set the inner MTU accordingly or increase the underlay MTU to 9000.

Ethernet standards follow the pattern [speed]BASE-[encoding/medium]:

• Number — Speed in Mbps (10, 100) or Gbps (1000, 10G, 25G, 100G, 400G)
• BASE — Baseband signaling (as opposed to broadband)
• T — Twisted pair copper
• SR — Short-reach fiber (multimode)
• LR — Long-reach fiber (single-mode, ~10 km)
• ER — Extended-reach fiber (single-mode, ~40 km)
• CR — Direct-attach copper (DAC cables in racks)

Data center relevance: Modern data centers typically run 25G to servers (replacing 10G), 100G for leaf-spine links, and are transitioning to 400G for spine-to-spine and core. If you're managing K8s clusters on bare metal, understanding these speeds and the cabling constraints (fiber type, distance limits, SFP compatibility) directly impacts your network design and procurement decisions.