Ethernet

Ethernet (IEEE 802.3) moves a frame from one network card to another on the same local network: a switch, a Wi-Fi access point, a virtual cable. Every card has a 48-bit MAC address, and every frame says which card it's for and which card sent it. Wi-Fi uses its own frame format over the air, but your system presents Wi-Fi traffic as Ethernet frames, and that's what NetOtter sees.

The header

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                 Destination MAC address                       |
+                               +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                               |                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               +
|                    Source MAC address                         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|           EtherType           |   Payload (46 to 1500 bytes)  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               +

Offset	Size	Field	Meaning
0	6	Destination	The card it's for. ff:ff:ff:ff:ff:ff = every card (broadcast).
6	6	Source	The card that sent it.
12	2	EtherType	What the payload is: 0x0800 IPv4, 0x86dd IPv6, 0x0806 ARP, 0x88cc LLDP... A value of 1500 or less is a length instead (802.3 / LLC frames).

On the wire there's more:

• a 7-byte preamble and a start delimiter before the header;
• a 4-byte checksum (the FCS) after the payload.

The network card strips them, so captures don't show them. A frame's payload is at least 46 bytes: shorter ones are padded with zeros, which is why IPv4 carries its own total length.

MAC addresses

00:00:5e:00:53:01 is written as six bytes in hex.

• First 3 bytes: usually the manufacturer's ID, its OUI. 00:00:5e belongs to IANA, which reserves 00:00:5e:00:53:xx for documentation.
• Lowest bit of the first byte: 1 for group addresses (multicast and broadcast). IPv6 multicast maps to 33:33:xx:xx:xx:xx, IPv4 multicast to 01:00:5e:….
• Second-lowest bit: 1 for locally administered addresses, like the random MAC addresses phones use on Wi-Fi.

Example: an ARP request

Before sending an IPv4 packet to 192.0.2.2 on the same network, the client must know that address's MAC. It broadcasts an ARP request (EtherType 0x0806):

0000  ff ff ff ff ff ff 00 00 5e 00 53 01 08 06 00 01
0010  08 00 06 04 00 01 00 00 5e 00 53 01 c0 00 02 01
0020  00 00 00 00 00 00 c0 00 02 02

Bytes	Field	Value
ff ff ff ff ff ff	Destination	broadcast: every card on the network
00 00 5e 00 53 01	Source	the client
08 06	EtherType	ARP
00 01	ARP: hardware type	1, Ethernet
08 00	ARP: protocol type	IPv4
06 04	ARP: address sizes	6-byte MAC, 4-byte IPv4
00 01	ARP: operation	1, request
00 00 5e 00 53 01 c0 00 02 01	ARP: sender	MAC and IP of the client, 192.0.2.1
00 00 00 00 00 00 c0 00 02 02	ARP: target	MAC unknown (zeros), IP 192.0.2.2

The server answers with an ARP reply (operation 2), sent straight to the client's MAC, with its own MAC in the sender field. Both sides remember the pair for a while.

In NetOtter:

#15    [veth0]     4.008620  00:00:5e:00:53:01     -> ff:ff:ff:ff:ff:ff             ARP      0 B  [who-has 192.0.2.2 tell 192.0.2.1]
#16    [veth0]     4.008652  00:00:5e:00:53:02     -> 00:00:5e:00:53:01             ARP      0 B  [192.0.2.2 is-at 00:00:5e:00:53:02]

Packet #15 on [veth0]
  Captured     2026-10-14 02:06:59.794143 (+4.008620 s)
  Ethernet     00:00:5e:00:53:01 -> ff:ff:ff:ff:ff:ff
  EtherType    ARP (0x0806)
  Operation    request (1)
  Sender       00:00:5e:00:53:01  192.0.2.1
  Target       00:00:00:00:00:00  192.0.2.2
  Payload      0 bytes

The frame is 42 bytes, under Ethernet's 60-byte minimum: the padding is added by the network card, after the capture point. On this virtual cable nothing pads at all, so the reply is 42 bytes too; from a physical card, a received ARP frame shows up with up to 18 bytes of zero padding.

In NetOtter

• Parsing: parse_eth(), called by parse_link() (see the Parsers functions), reads the header and sets net_proto. ARP is decoded by parse_arp().
• Raw IP links: VPN tunnels deliver raw IP packets without an Ethernet header. NetOtter then guesses the EtherType from the IP version.
• Display: l shows the MAC addresses for ARP and non-IP frames, and the IP addresses otherwise; i always shows the Ethernet line.
• Filters: etype arp, etype 0x88cc, etype llc. The IPv4 filters also match ARP's sender and target addresses.

Read more

• IEEE 802.3 (Ethernet)
• RFC 826: ARP
• RFC 7042: IANA's MAC address ranges, including the documentation ones
• IANA EtherType list