A.2.1 MAC Address

Ethernet MAC addresses identify MAC layer entities (physical or logical/virtual interfaces or ports) in networks that implement the IEEE MAC sublayer functions of the data link layer (OSI or TCP/IP reference model). As with most data link addresses, MAC addresses are unique for each MAC port or interface. Ethernet MAC addresses are formatted according to rules set by the IEEE and can be done using one of the following three numbering name spaces (managed by the IEEE): MAC-48, EUI-48 [IEEESAEUI48], and EUI-64 [IEEESAEUI64], where EUI stands for Extended Unique Identifier.

Most Layer 2 networks use one of these three primary numbering spaces – MAC-48, EUI-48, and EUI-64. EUI-48 and EUI-64 identifiers are commonly used to create globally unique interface addresses (also called universally unique MAC addresses). These globally unique addresses are specified in a number of standards that discuss Layer 2 and 3 addressing. Ethernet and ATM interfaces use the MAC-48 address space. IPv6 interface identifiers use the EUI-64 address space.

All three numbering systems use the same format and differ only in the length of the identifier (Figure A.2). The first three bytes in the figure, known as the Organizationally Unique Identifier (OUI), identify the issuer (i.e., organization) of the MAC-48, EUI-48, or EUI-64 identifier [IEEESAOUICID]. These first three byes (which are administered by the IEEE), shown in the figure in transmission order, identify the issuer (assignee or owner), who can be a manufacturer, vendor, or any other organization globally or worldwide.

OUIs are purchased from the IEEE Registration Authority by the issuer/assignee. The IEEE Registration Authority administers the assignment of these (OUI) identifiers and ensures that they are globally unique to each organization that receives an identifier. The OUIs are used as the first 3 bytes (24 bits) of identifiers in any one the three numbering name spaces (e.g., MAC-48, EUI-48, and EUI-64) to uniquely identify a particular physical or logical interface in a network. When creating an Ethernet MAC address, the OUI is combined with a 3 byte (24 bit) number (assigned by the owner of the OUI) to form the complete Ethernet MAC address. As shown in Figure A.2, the first three bytes of the MAC address are the OUI.

The next 3 bytes in the NIC specific field (for the MAC-48 and EUI-48 formats in Figure A.2) or 5 bytes (for the EUI-64 format) are assigned by the OUI owner (organization) based on their own allocation rules, as long as the addresses are unique. The last 3 (or 5) bytes are typically created using the serial number of the interface, or any other value administered by the OUI owner. MAC-48 and EUI-48 spaces each result in 48 bit addresses, while EUI-64 spaces result in 64 bit addresses, but all three use the same OUI format.

The MAC addresses (with the NIC specific part assigned by the manufacturer of a MAC device) are generally stored in a device's hardware, such as the device's network interface read-only memory (ROM) or some other software or firmware component. The ROM encodes the MAC address (OUI plus NIC-specific number) and is sometimes referred to as the burned-in address (BIA). BIA means the MAC address is stored permanently in the ROM and is copied into an associated random-access memory (RAM) when the interface powers up and initializes. The BIA is also referred to in the network industry by terms such as physical address, hardware address, or Ethernet hardware address (EHA).

In the first byte of the OUI (Figure A.2), the two least-significant-bits of the second set of 4 bits (second nibble) are used as flag bits for some protocol functions. These flag bits can be used to indicate whether the MAC address is an individual (unicast) address or group (multicast) address, or whether a MAC address is universally or locally administered, and so on. As already noted, MAC addresses can either be universally administered or locally administered [IEEESAGMAC].

Universally administered and locally administered addresses are distinguished by appropriately setting the second least significant bit of the most significant byte of the MAC address (indicated by the “Bit 2” bit in Figure A.2). This bit is also referred to as the U/L bit, short for Universal/Local, which identifies how the address is administered.

• Universally Administered Addresses: If the “Bit 2” (U/L) bit is 0, the address is universally administered by the IEEE (through the assignment/designation of a unique owner/company ID (the OUI)). A universally administered address is unique but the NIC-specific part is assigned to a device by its manufacturer.
• Locally Administered Addresses: If the “Bit 2” (U/L) bit is 1, the address is locally administered. A locally administered address is assigned to a device by a network administrator, overriding any burned-in address. Locally administered addresses do not contain OUIs.

The least significant bit of the most significant byte of an address (“Bit 0” bit in Figure A.2) indicates whether an address is an individual (unicast) address or group (multicast) address [IEEESAGMAC]. This bit is also referred to as the I/G bit, short for Individual/Group, which identifies how the address is used.

• Individual (Unicast) Address: The “Bit 0” (I/G) bit is set to 0 in individual addresses; meaning if the least significant bit of the most significant octet of an address is set to 0 (zero), the frame is destined to only one receiving interface (unicast transmission).
• Group (Multicast) Address: The “Bit 0” (I/G) bit is set to 1 in group addresses. If the least significant bit of the most significant address octet is set to 1, the frame is destined to more than one receiver (group of receivers). The sender transmits the frame only once, and a receiver accepts the frame based on a configurable list of multicast MAC addresses it maintains. Group addresses include broadcast and multicast addresses, and not unicast or individual addresses. Group addresses, like individual addresses, can be universally or locally administered.

A.2.2 IEEE 802.1Q Tagging Option – VLAN Tagging Option

The Ethernet frame header contains destination and source MAC addresses (each 6 bytes in length), the Type/Length field, and, optionally, an IEEE 802.1Q tag (Figure A.3). The optional 4-octet IEEE 802.1Q tag is a field that is used to carry information about the Virtual LAN (VLAN) membership and IEEE 802.1p priority of a frame. The minimum payload of the Ethernet frame is 42 bytes when it carries an IEEE 802.1Q tag and 46 bytes when the tag is absent (untagged frame). The maximum Ethernet frame payload, as discussed above, is 1500 bytes. Nonstandard jumbo frames are larger size frames, carrying payloads much larger than 1500 bytes, and allow for larger maximum payload size to be transported.

VLAN tagging (using IEEE 802.1Q tags) is a MAC frame formatting option that provides three important capabilities not previously available to Ethernet network users and network managers using untagged frames:

• VLAN tagging provides a means to tag frames with priority settings according to traffic type and quality of service (QoS) requirement so that they can be given differentiated service in a network.
• VLAN tagging allows frames from end stations to be tagged and assigned to Layer 2 broadcast domains or logical groups (VLANs) in a network. Users, even if not collocated within a logical group, can communicate with each other across the network as if they were on a single LAN. Layer 2 switches will examine destination MAC addresses and VLAN tags and forward frames only to ports that serve the VLAN to which the traffic belongs.
• VLAN tagging simplifies network management and makes adding, moving, and changing end-stations and network equipment in the network much easy to carry out.

As shown in Figure A.3, a VLAN-tagged frame is simply a basic MAC frame that has a 4 byte VLAN tag/header (IEEE 802.1Q tag) inserted/placed between the source MAC address and Type/Length fields.

The 32 bit IEEE 802.1Q tag field is placed between the source MAC address and the Type/Length fields of the basic frame (Figures A.4–A.6). The IEEE 802.1Q tag consists of the following parts:

• Tag Protocol Identifier (TPID): The 2 byte TPID field is set to a value of 0x8100 (in hexadecimal) to identify an Ethernet frame as carrying an IEEE 802.1Q-tagged. As illustrated in Figure A.4 Figure A.5 Figure A.6, the TPID field is at the same position as the Type/Length field in untagged Ethernet frames. This allows IEEE 802.1Q tagged frames to be quickly distinguished from untagged frames.
• Tag Control Information (TCI): The 2 byte TCI field consists of a 3 bit Priority Code Point (PCP) (or User Priority), 1 bit Drop Eligible Indicator (DEI) (formerly the Canonical Format Indicator (CFI)) and 12 bit VLAN Identifier (VLAN ID) as shown in Figure A.5.
  • - Priority Code Point (PCP): The 3 bit PCP (or User Priority) field refers to the IEEE 802.1p priority class of service and indicates the Ethernet frame's priority level. These PCP values can be used to prioritize different classes of traffic (voice, video, data, etc.).
  • - Drop Eligible Indicator (DEI): The 1 bit DEI field (formerly designated as the CFI) can be used separately or in conjunction with PCP to indicate an Ethernet frame as eligible to be dropped when the need arises in the network.
  • - VLAN Identifier (VLAN ID): The 12 bit VLAN ID field carries a value that specifies the VLAN to which the Ethernet frame belongs.

In the range of values covered by the 12 bit VLAN ID field (Figure A.4 and A.5), the values 0x000 and 0xFFF (in hexadecimal) are reserved. The remaining (2¹²−1) values are available to be used as VLAN identifiers, meaning up to 494 VLANs can be created.

• The Null VID (0x000): The reserved value 0x000, when carried in a tagged Ethernet frame, indicates that the frame does not belong to any VLAN (no valid VLAN identifier is carried in the frame). It indicates that the IEEE 802.1Q tag header (i.e., the TCI) contains only frame priority information (in PCP and DEI fields). The 0x000 VLAN ID value is not to be used as a Port VLAN ID, member of a VLAN ID set, configured in any Ethernet address filtering database entry, or used in any management operation.
• The Default VID (x001): In Layer 2 networks, the 0x001 VLAN ID or VLAN 1 (normally designated the default VLAN ID) is often reserved for identifying Ethernet frames belonging to a management VLAN, but its use is also vendor-specific.
• Reserved for Implementation Use (0xFFF): The 0xFFF VLAN ID value is reserved and is not to be used as a Port VLAN ID, member of a VLAN ID set, or carried in an IEEE 802.1Q tag of an Ethernet frame. This VLAN ID value is sometimes used to indicate a wildcard match in the VLAN ID field in Ethernet address filtering database entries or in searches involving the VLAN ID in management operations.

As illustrated in Figure A.7, IEEE 802.1Q tagged frame has a 4 byte field added between the source MAC address and the Type/Length fields of the basic standard Ethernet frame. With tagging, the minimum frame size remains unchanged at 64 bytes (octets) but the maximum frame size extends from 1518 to 1522 bytes.

With IEEE 802.1Q tagging, the minimum payload in the frame is 42 bytes while without tagging the frame carries the basic standard minimum payload of 46 bytes. During tagging, a device adds 2 bytes for the TPID and 2 bytes for the TCI. The device also has to fill in the TCI fields (PCP, DEI, and VID) with the appropriate information. By inserting the IEEE 802.1Q tag, the frame size and contents change, thereby requiring the device to recalculate and update the FCS field in the Ethernet trailer.

The Maximum Transmission Unit (MTU) is the size (in bytes) of the largest protocol data unit (PDU) that a particular protocol layer can forward to the next entity. The Ethernet frame size specifies the size of the complete Ethernet frame, including the header and the trailer, but the MTU size in Ethernet refers only to the Ethernet payload. The standard Ethernet frame (not Jumbo frames) has an MTU of 1500 bytes (Figure A.7). The MTU does not include the Ethernet header plus the Cyclic Redundancy Check (CRC) trailer (which is carried in the Frame Check Sequence (FCS) field) in the untagged frame. The header plus the trailer in the untagged frame are 18 bytes in length, resulting in total Ethernet frame size of 1518 bytes.

“Baby giant” frames is a term that refers to Ethernet frames with MTU sizes greater than the standard maximum MTU size up to 1600 bytes. “Jumbo” frames is used to refer to Ethernet frames with MTU sizes up to 9000 bytes [CISCBABY, ETHERALL09]. By extending the maximum Ethernet frame size from 1518 to 1522 bytes due to IEEE 802.1Q tagging (to accommodate the 4 byte tag), some network devices that cannot process tagged frames simply discard such frames. Some network devices that do not support processing for these larger tagged frame size will process and forward the tagged frame successfully, but may flag them as malformed “baby giant” packets [CISCBABY].

A network can be configured to have segments that are VLAN-aware (i.e., IEEE 802.1Q enabled), where frames carry VLAN tags, and segments that are VLAN-unaware (i.e., IEEE 802.1D enabled), where frames do not include VLAN tags. A VLAN tag is added to a frame when it enters the VLAN-aware segment of the network, (see Figure A.7) to specify/indicate the VLAN membership of the frame. Each frame must be recognizable and distinguishable as belonging to precisely only one VLAN. A frame in the VLAN-aware segment of the network that does not carry a VLAN tag is assumed to belong to the native (or default) VLAN.

The 12 bit VLAN ID field in the IEEE 802.1Q tag allows a theoretical maximum of 4096 VLANs to be supported (4094 in practice, taking away the 0x000 and 0x001 VLAN IDs). While this maximum number may be adequate for most smaller networks, there are many networking scenarios where double-tagging (IEEE 802.1ad, also known as provider bridging, Stacked VLANs, or simply QinQ or Q-in-Q) need to be supported. Double-tagging can be useful for large networks and Internet service providers, allowing them to support a larger number of VLANs, in addition to other important benefits. Double-tagging can support a theoretical maximum of 4096 × 4096 = 16,777,216 VLANs.

A.2.3 Ethernet Byte and Bit Ordering

The endianness of a network protocol defines the order in which the protocol sends and receives bits and bytes of an integer field of protocol data. In a big endian system, the most significant byte (or bit) is transmitted first. By contrast, in a little endian system, the least significant byte (or bit) is transmitted first. The little endian and big endian bit ordering are illustrated in Figure A.8.

Lower layer protocols, such as Ethernet, Token Ring, FDDI, and ATM, define the order in which bit/byte transmission/reception should occur, and in some of these lower layer protocols the order is the reverse of that of the supported upper-layer protocol. In Ethernet transmission, the byte order is big-endian, that is, leftmost or most significant byte is sent first.

However, the bit order of Ethernet is little endian, that is, the bit corresponding to the 2⁰ numerical position or LSB (least significant bit) of the byte is sent first, and the bit corresponding to the 2⁷ numerical position or MSB (most significant bit) is sent last. Figure A.9 shows the byte ordering and bit ordering in the Ethernet frame. The bytes in each field are transmitted in big endian, meaning “left byte first,” but the bits within each byte are transmitted in the reverse order “LSB first.”

IEEE 802.3 (Ethernet) (and IEEE 802.4 (Token Bus)) transmit the bytes (octets) over the transmission medium, left-to-right, with least significant bit in each byte first (Figure A.9). Also by convention, when writing binary fields, the LSB is shown as the leftmost bit and the MSB as the rightmost. This is also the standard notation (also called canonical format) for MAC addresses, that is, addresses are written in transmission bit order with the LSB transmitted first.

For example, an address in canonical form 12-34-56-78-9A-BC would be transmitted over the transmission medium as bits 01001000 00101100 01101010 00011110 01011001 00111101 in the standard transmission order (LSB first). IEEE 802.5 (Token Ring) and IEEE 802.6, on the other hand, send the bytes over the transmission medium with the MSB first.

There is an important exception in Ethernet data transmission as noted in Figure A.9. Except for the FCS (which has the same byte ordering but a different bit ordering), data on other Ethernet frame fields is transmitted with most significant octet (byte) first, and within each octet, the least significant bit is transmitted first. The byte and bit orders are typical for all fields except the FCS, which is treated as a special 32 bit field rather than as four individual bytes. In the FCS, the high-order bit (MSB) of the sequence is transmitted first.

As discussed above, the 48 bit MAC address (universal or local) is normally represented as a string of 6 octets. The octets are written from left to right, in the order that they are transmitted on the transmission medium, separated by hyphens (−) or colons (:). Each octet of the address is expressed as two hexadecimal symbols. The bits within the octets are transmitted on the transmission medium from left to right.

In the binary representation, the first bit transmitted of each octet on the transmission medium is the LSB of that octet. The I/G address bit is the least significant bit. The leftmost bit of the binary representation (I/G address bit) of a MAC address distinguishes individual from group addresses. The U/L administered address bit is the next bit following the I/G address bit. The U/L bit indicates whether the MAC address has been universally or locally assigned.

A.2.4 Legal Ethernet Frames: Untagged Frames

The minimum and maximum Ethernet frame sizes (in bytes) are determined as follows:

1. Full minimum frame size = header (14) + CRC (4) + DataMin (46) = 64
2. Full maximum frame size = header (14) + CRC (4) + DataMax (1500) = 1518

When calculating the frame sizes, the IPG (Inter-Packet Gap), 7 byte Preamble, and 1 byte SFD (Start-of-Frame Delimiter) are not included in the frame size calculations as they are not considered part of the Ethernet frame. The header consists of three parts: 6 byte Destination Address, 6 byte Source Address, and 2 byte Type/Length field