4.1: Introduction

A network switch or Ethernet switch is a multi-port networking hardware system that connects devices on a computer network using packet switching to receive, process, and forward data to a destination device whose address is in the packet.[1]

A simple network hub broadcasts the same data out of each of its ports. However, a network switch forwards data only to one or multiple devices that need to receive the packet.[2]

Packet Switching

Packet switching is a method of grouping data to be transmitted over a telecommunications network into short messages in a fixed format, called a packet.

Packets consist of a "header" section and a "payload" section.

• The header provides the means for directing a packet to its destination (e.g., Destination MAC address)
• The payload consists of the actual data that an application wants to transmit.[3]

In the Open Systems Interconnect (OSI) model developed by the International Organization for Standardization (ISO), there are several layers:

1. Physical layer
2. Data Link layer
3. Network layer
4. Transport layer
5. Session layer
6. Presentation layer
7. Application layer.

Ethernet frame

An Ethernet frame is a data link layer (Layer 2) protocol data unit that uses the underlying Ethernet physical layer (Layer 1) transport mechanisms.

• Layer 2 is the layer at which one transmits data frames between two network nodes that are connected by a physical layer.
• Layer 1 handles the transmission and reception of bit streams over a physical medium (e.g., copper cable, fiber optic cable).

An Ethernet frame (described below) is preceded by a "preamble" and a "start frame delimiter (SFD):, which are both part of the Ethernet packet at the physical layer (Layer 1).

An Ethernet frame consists of:

• An Ethernet header, which contains destination and source Media Access Control (MAC) Addresses as its first two fields. A MAC address is a unique identifier assigned by network device manufacturers and are typically store in the device's read-only memory.
• The middle section of the frame is payload data, including any headers for other protocols (for example, Internet Protocol) carried in the frame.
• The frame ends with a Frame Check Sequence (FCS), which is a 32-bit Cyclic Redundancy Check (CRC) that is used to detect any in-transit corruption of data.[4]

An Ethernet packet is shown in Figure \(\PageIndex{1}\).

Figure \(\PageIndex{1}\): Ethernet packet. The SFD (start frame delimiter) marks the end of the packet preamble. It is immediately followed by the Ethernet frame, which starts with the destination MAC address. (Ethernet frame - Wikipedia, in the public domain)

Accessibility Note

An Ethernet packet is structured as follows:

• Preamble
• Start Frame Delimiter (SFD)
• Destination MAC Address
• Source MAC Address
• Ethertype
• Payload
• Frame Check Sequence (FCS)

A data packet on the wire and the frame as its payload consist of binary data. Ethernet transmits data with the most-significant octet of eight bits (byte) first; within each octet, however, the least-significant bit is transmitted first.[4]

The internal structure of an Ethernet frame is specified in the IEEE 802.3 specification. Figure \(\PageIndex{2}\) shows the complete Ethernet packet and the frame inside, as transmitted, for the payload size up to the Maximum Transmission Unit (MTU) of 1500 octets. Some implementations of Gigabit Ethernet and other higher-speed variants of Ethernet support larger frames that are called jumbo frames.[4]

Figure \(\PageIndex{2}\): 802.3 Ethernet packet and frame structure. (Ethernet frame - Wikipedia)

Accessibility Note

802.3 Ethernet packet and frame structure showing the number of octets in each component:

• Preamble: 7 octets
• Start Frame Delimiter (SFD): 1 octet
• Frame: 64 to 1522 octets
  • Destination MAC Address: 6 octets
  • Source MAC Address: 6 octets
  • Ethertype or length: 2 octets
  • Payload: 42-1500 octets
  • Frame Check Sequence (FCS): 4 octets

Ethernet II framing

Ethernet II framing defines the two-octet Ethertype field in an Ethernet frame, that is located right after the destination and source MAC addresses. It identifies an upper layer protocol encapsulated by the frame data.

For example:

• an EtherType value of 0x0800 indicates that the frame contains an IPv4 datagram (IPv4 supports 4 billion (2³²) addresses with a 32-bit address).
• 0x0806 indicates an Address Resolution Protocol (ARP) datagram,
• 0x86DD indicates an IPv6 datagram.[4] IPv6 uses 128-bit addresses, supporting an address space of 2¹²⁸, or 10³⁸

As this industry-developed standard went through a formal Institute of Electrical and Electronics Engineers (IEEE) standardization process, the EtherType field was changed to a (data) length field in the new 802.3 standard.

Since the packet receiverl needs to know how to interpret the frame, the standard required an IEEE 802.2 header to follow the length and specify the type. IEEE 802.2 defines Logical Link Control (LLC) as the upper portion of the data link layer of the OSI model.[5]

In the 802.3x-1997 standard, and later versions of the 802.3 standard, formally approved of both types of framing. Ethernet II framing is the most common in Ethernet local area networks, due to its simplicity and lower overhead.[4]

Figure \(\PageIndex{3}\): Ethernet Type II frame. (Ethernet frame - Wikipedia[4] in the public domain)

Accessibility Note

An Ethernet Type II frame is structured as follows:

• MAC Header (14 bytes)
  • Destination MAC Address
  • Source MAC Address
  • Ethertype
• Data/Payload (46-1500 bytes)
• CRC Checksum (4 bytes)

Location in a network

Access Switches

Access switches reside at the edge of a network, connecting WiFi access points, IP telephones sitting on the desks of employees, Ethernet-cabled equipment such as servers, security cameras, and so on. Some of the connections may require support for Power over Ethernet (PoE) in which the Ethernet cable provides power from the switch to the connected device, supporting 15, 30, or 60 watts.

Access switches often are placed in wiring closets.

Aggregation Switches

Aggregation switches serve to connect access switches, aggregating traffic from access switches for transport to the network core switch or switches. The up-link speeds of aggregation switches tend to be higher. Additionally, they have more Layer 3 routing functionality.

Core Switch

Core switches are connected to aggregation switches and would be connected to a router for connectivity to a Wide Area Network (WAN) and the internet.

Switch functions

A network switch needs to learn MAC addresses. As part of the learning process, it might store the addresses in a pice of specialized hardware called a Content Addressable Memory (CAM).

The switch has to forward packets to the specified destination, i.e, the Destination MAC address at Layer 2 or the IP address in a Layer 3 network. It may forward the packet to the next hop on its way to its ultimate destination.

More advanced switches might incorporate security features such as Virtual Private Networks and encryption.

References

1. Network switch - Wikipedia. Accessed February 4, 2026.
2. Networking hardware - Wikipedia. Accessed February 4, 2026.
3. Packet switching - Wikipedia. Accessed February 4, 2026.
4. Ethernet frame - Wikipedia. Accessed February 4, 2026.
5. IEEE 802.2 - Wikipedia. Accessed February 15, 2026.
6. Ethernet packet image.