Parse an Ethernet Frame Manually

Ethernet II Frame Layout

Ethernet is the dominant link-layer technology for LANs. The Ethernet II header is 14 bytes before the payload begins. For example, bytes 12-13 hold the EtherType: 0x0800 means IPv4, 0x0806 means ARP.

Field Breakdown

A typical frame on the wire:

• Destination MAC (bytes 0-5): e.g. ff:ff:ff:ff:ff:ff for broadcast
• Source MAC (bytes 6-11): e.g. aa:bb:cc:dd:ee:ff
• EtherType (bytes 12-13): upper-layer protocol identifier
• Payload (46-1500 bytes): IP packet or ARP message
• FCS (4 bytes): CRC32 checksum (often stripped by the NIC before capture)

Frame size constraints: minimum 64 bytes, maximum 1518 bytes including FCS. Payloads shorter than 46 bytes get padded.

Parsing Steps

To parse a captured frame manually:

1. Read destination MAC from bytes 0-5
2. Read source MAC from bytes 6-11
3. Read EtherType from bytes 12-13 (watch for VLAN tag 0x8100)
4. Payload starts at byte 14

Why This Exercise

This task requires you to parse a simulated Ethernet frame byte array. You will use this exact 14-byte header layout in every tcpdump capture and when you build ARP requests with raw sockets later in the track. Switches forward frames based on the destination MAC you extract here, and VLAN-tagged frames with EtherType 0x8100 shift the IP payload start past byte 14.