Ethernet und ARP Referenz
Referenz für Ethernet framing, MAC addressing, ARP, und switching.
Frame Structure
Ethernet frames consist of preamble, destination MAC, source MAC, EtherType/length, payload, and FCS. The minimum frame size is 64 bytes (excluding preamble); maximum is 1500 bytes (MTU) for standard Ethernet. Jumbo frames extend MTU to 9000 bytes for efficiency. EtherType identifies the upper protocol (0x0800 for IPv4, 0x86DD for IPv6). The FCS is a CRC-32 checksum for error detection. VLAN tags (802.1Q) add 4 bytes for network segmentation.
- MAC
- 48-bit hardware address
- EtherType
- Protocol identifier
- FCS
- CRC-32 checksum
hex:hex:hex...0x0800 = IPv4error detectionARP and Switching
ARP (Address Resolution Protocol) maps IPv4 addresses to MAC addresses on the local network. ARP requests are broadcast; replies are unicast. IPv6 uses Neighbor Discovery Protocol (NDP) instead of ARP. Ethernet switches learn MAC addresses by observing source addresses and build forwarding tables. Unknown destinations are flooded to all ports. CAM table capacity limits switch scale. ARP spoofing/poisoning is a common LAN attack vector.
- ARP
- IP to MAC mapping
- NDP
- IPv6 neighbor discovery
- switching
- MAC learning
broadcast requestreplaces ARPCAM table