JOVANA
Explore Library Glossary Getting Started Three Levels Fields How it works Mission
Join the mission
All guides

Ethernet: The LAN That Took Over the World

Almost every wired local network on Earth speaks Ethernet. Here is the addressed envelope it sends, the rules it once used to share a wire, and why a frame format that barely changed in fifty years quietly won.

The local network beneath everything

By now you know the layered picture: an application hands data down, the link layer wraps it for the wire, and somewhere out there a router carries it across networks. This rung zooms all the way in on one floor of that building — the local area network, the cluster of machines in one office, home, or building that can hand data directly to one another. And almost everywhere that local network is wired, the technology underneath is Ethernet. When you plug into a wall jack, or when a Wi-Fi access point connects back to a router, the wire is speaking Ethernet.

Ethernet is a layer-2 technology, which means it moves data only between machines on the same local network, using MAC addresses rather than IP addresses. Every network interface is burned with a globally unique MAC address — six bytes, usually written as twelve hex digits like de:ad:be:ef:00:01. Think of the IP address as the postal address that gets a letter to the right building anywhere on Earth, and the MAC address as the name on the office door that gets it to the right desk inside this building. Ethernet only cares about the door; getting to the building is IP's job, one layer up.

The frame: one addressed envelope

Everything Ethernet sends travels inside one unit: an Ethernet frame, a single addressed envelope dropped onto the local network. A web request, a file chunk, a video packet — each gets wrapped in a frame before it leaves the network card. The brilliant part is that the envelope has fixed parts in a fixed order, so any switch or card can read the front of it in hardware at full speed without understanding a single byte of what is inside.

[ preamble ][ dst MAC ][ src MAC ][ type ][        payload        ][ CRC ]
   8 bytes    6 bytes    6 bytes   2 bytes      46 .. 1500 bytes      4 bytes
                                  0x0800
                                = IPv4 inside

  dst aa:bb:cc:11:22:33  -> where it goes (read first, so a switch decides fast)
  src de:ad:be:ef:00:01  -> who sent it  (this is what a switch LEARNS from)
The fixed layout of an Ethernet frame; the addresses sit right up front so forwarding needs no peek at the payload.

Walk it left to right. The preamble is a repeating bit pattern that lets the receiver's clock lock onto the incoming bits, ending in a start-of-frame marker. Then the 6-byte destination MAC (where it goes) and the 6-byte source MAC (who sent it). The 2-byte type field says what is inside — the value 0x0800 means "an IPv4 packet," so the receiver knows to hand the payload up to the network layer. The payload itself is the real data, between 46 and 1500 bytes; that 1500-byte ceiling is the Ethernet MTU, and it is exactly why a large file is chopped into many frames rather than sent as one. Finally a 4-byte CRC (a checksum called the frame check sequence) lets the receiver detect corruption.

From a shared wire to a private lane

The original 1970s Ethernet was strikingly different from today's. Every machine tapped into one long coaxial cable — a single party-line that everyone shared. With one wire, only one machine can talk at a time, and if two start at the same instant their signals collide and both are garbled. Ethernet's answer was a politeness rule called CSMA/CD: listen before you talk (carrier sense), and if you detect a collision while sending, stop, wait a random backoff time, and retry. It worked, but the more machines shared the cable, the more they collided and the less real bandwidth each one got.

Modern Ethernet quietly threw that whole problem away. Instead of one shared cable, every machine gets its own point-to-point link into a switch, with separate wire pairs for sending and receiving. With a private lane in each direction, there is simply nothing to collide with, so links run full-duplex — a machine sends and receives at the same instant, like a phone call where both people speak at once, rather than a walkie-talkie where you take turns. A 1 Gbps full-duplex link effectively carries 1 Gbps up and 1 Gbps down simultaneously. On such a link CSMA/CD is not just unused, it is unnecessary: collision detection has nothing to detect.

Why a fifty-year-old format won

Here is the quietly remarkable part of Ethernet's story. Over fifty years its speed climbed from 10 Mbps over coax to 100 Mbps, 1 Gbps, 10 Gbps, and on to 100 Gbps and beyond over twisted pair and optical fiber — a thousandfold and more. Yet the frame format barely changed: the same destination MAC, source MAC, type, payload, and CRC you saw above. That stability is exactly why it won. An old program and a new program describe data the same way, even though the wire underneath is a thousand times faster. Standardized as IEEE 802.3, Ethernet outlasted every flashier rival because it stayed boringly compatible.

This is the right place to be careful about three words that beginners blur together. Climbing from 100 Mbps to 1 Gbps is more bandwidth — a wider pipe, more bits per second. That is not the same as throughput (the actual rate you achieve, after overhead, errors, and slower hops along the way) and it is certainly not latency (how long one bit takes to arrive). A faster Ethernet link sends more bits per second, but the first bit does not arrive any sooner — you cannot beat the speed of light through the wire. More bandwidth does NOT cut latency, and that distinction will matter again and again as you climb.

One more honesty note. Because Ethernet only delivers between machines on the same LAN, it cannot route across the Internet — that is IP's job, one layer up. And the rest of this rung exists because a bare frame is not enough on its own. The switch that learns where everyone sits, the rules that stop loops, the way one physical LAN gets sliced into many — those are the next four guides. Ethernet is the envelope; the rest of this rung is the post office around it.

The helpers every LAN needs

Two small protocols quietly make a LAN usable, and they are worth meeting now because everything else assumes them. The first solves an obvious gap: a host knows the IP address it wants to reach, but Ethernet delivers by MAC, not by IP. The Address Resolution Protocol (ARP) is the translator. It is like knowing someone's name but needing their seat number to hand them a note: the host broadcasts "who has 192.168.1.20? tell me your MAC," the one machine that owns that IP answers with its MAC, the host caches the mapping, and only then can it build the frame.

  1. A device joins the LAN with no settings at all. It broadcasts a DHCP Discover: "are any servers out there?"
  2. A DHCP server replies with an Offer: "you can have 192.168.1.50, mask 255.255.255.0, gateway 192.168.1.1, DNS 192.168.1.1."
  3. The device broadcasts a Request accepting that offer.
  4. The server sends an Acknowledgment confirming the lease, and the device is online — all in about a second.

That four-step dance — remembered as DORA — is DHCP, the protocol that hands a new device its address, subnet mask, gateway, and DNS servers automatically the moment it joins, like a hotel front desk instantly giving you a room key and the floor plan. Two honest caveats tie back to earlier rungs: the address is a temporary lease tied to a location, not a permanent name for your device, so the same laptop gets a different IP on every network. And both ARP and DHCP are unauthenticated — a host believes any reply — so a forged ARP answer or a rogue DHCP server can quietly hijack a victim's traffic. Convenient, invisible, and trusting: that is the LAN you are about to take apart.