How Ethernet Works

How does Ethernet work?

Ethernet works by packing data into frames that carry a destination and source MAC address, which a switch forwards to the right port using an address table it learns by itself, while IP, ARP and the default gateway decide whether traffic stays inside the local subnet or continues via a router. Ethernet itself operates at Layers 1 and 2 of the OSI model; IP addresses, subnet masks and gateways belong to Layer 3. Once you understand how those layers interact, you can trace faults between PLCs, HMIs and servers much faster. This article explains the mechanism step by step; for history, cable types and speeds, see the main article on Ethernet.

🧠 At which OSI layers does Ethernet operate?

Ethernet is standardised as IEEE 802.3 and covers the physical layer and the data link layer. At Layer 1 the standard defines speeds from 10 Mbit/s to 800 Gbit/s (IEEE 802.3df, 2024) over twisted pair, coaxial cable and fibre; on the plant floor 100 Mbit/s to 1 Gbit/s is typical. Everything above Layer 2, from IP to OPC UA, travels inside the Ethernet frame as payload.

Not every industrial protocol uses all layers. PROFINET RT and EtherCAT place their real-time data directly in an Ethernet frame, without IP or TCP, to keep delay low. Modbus TCP and IP run over the full TCP/IP stack.

📦 How is an Ethernet frame structured?

Every message on an Ethernet network travels as a frame. Its layout has barely changed since the 1980s:

Excluding the preamble, a frame is at least 64 bytes and at most 1,518 bytes (1,522 with a VLAN tag). The minimum stems from the original 512-bit slot time, which was needed to detect collisions on a shared cable. Between two frames a transmitter must stay idle for at least 96 bit times (12 bytes). Jumbo frames of around 9,000 bytes are supported by many switches, but they are not part of IEEE 802.3.

The EtherType field tells the receiver what the payload contains. A value of 1,500 or less is a length (the original IEEE 802.3 format); a value from 0x0600 upwards is a protocol code:

🤖 How does a MAC address work?

A MAC address is the 48-bit address (EUI-48) of a network interface at Layer 2, usually written as six hexadecimal pairs such as 00:1A:2B:3C:4D:5E. The first three bytes form the OUI (Organizationally Unique Identifier), which the IEEE assigns to a manufacturer; the manufacturer numbers the last three bytes itself.

Two bits in the first byte have a special meaning:

• I/G bit (least significant bit) - 0 means unicast to a single receiver, 1 means a group address (multicast or broadcast)
• U/L bit (second bit) - 0 means a globally unique factory address, 1 a locally administered address

The broadcast address FF:FF:FF:FF:FF:FF reaches every device in the same network segment. The factory address is often called burned-in, but most interfaces can be given a different address in software. That is legitimate for virtual machines and for phones and laptops that randomise their MAC address for privacy. An attacker uses the same capability for spoofing, which is why MAC Filtering on its own is not strong protection.

🔀 How does a switch decide where a frame goes?

A switch operates at Layer 2 and forwards frames; routing only happens at Layer 3. The principle is called transparent bridging and follows five steps:

1. Learn - for every incoming frame, the switch records the source MAC address and the port in its MAC address table
2. Look up - the switch looks up the destination MAC address in that table
3. Forward - if the address is known, the frame goes to that one port only
4. Flood - if the address is unknown, or the frame is a broadcast, it goes to every port in the same VLAN except the one it arrived on
5. Age - a learned address is removed after a fixed period without traffic; IEEE 802.1D recommends 300 seconds

Because every switch port is a separate link in full duplex, both ends can transmit simultaneously and no collisions occur. The old access method CSMA/CD (listen, transmit, stop on a collision and wait a random time) is only needed in half duplex; from 10 Gbit/s upwards Ethernet is full duplex only. Switches usually work store-and-forward (receive the whole frame and check the FCS first) or cut-through (forward as soon as the destination address has arrived, which lowers latency).

Loops in a switched network are dangerous: a broadcast keeps circulating and brings the network down (a broadcast storm). Protocols such as RSTP therefore block redundant paths. A managed switch adds VLANs, QoS and a mirror port (SPAN) for analysis with Wireshark.

🌐 What do the IP address, subnet mask and default gateway do?

An IP address is a logical address at Layer 3: IPv4 uses 32 bits (for example 192.168.1.10), IPv6 uses 128 bits. The subnet mask determines which part identifies the network and which part the device. Devices with the same network part can reach each other directly over Ethernet; every other destination requires a router.

The default gateway is the IP address of the router in the local subnet. A device with address 192.168.1.20/24 and gateway 192.168.1.1 sends traffic for, say, 8.8.8.8 to that gateway, which routes it onwards. The address blocks 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 are private addresses under RFC 1918; they are not routed on the internet and need NAT for internet access. A device that gets no address from DHCP often assigns itself a link-local address in 169.254.0.0/16, a well-known symptom behind a “PLC unreachable” report.

🔧 How does communication between two devices work step by step?

Suppose an HMI at 192.168.1.20/24 wants to read a value from a PLC at 192.168.1.50.

1. Subnet check - the HMI compares the network part of both addresses and sees that the PLC is in the same subnet
2. ARP cache - the HMI checks whether it already knows the MAC address of 192.168.1.50
3. ARP request - if not, the HMI broadcasts “who has 192.168.1.50?” (EtherType 0x0806); ARP is defined in RFC 826 from 1982
4. ARP reply - only the PLC answers, sending its MAC address directly to the HMI
5. Build the frame - the HMI places the IP packet with the TCP or UDP data in a frame addressed to the PLC’s MAC address, with EtherType 0x0800
6. Switching - the switch forwards the frame to the PLC’s port; the PLC checks the FCS and processes the data

If the destination lies outside the subnet, step 3 changes: the HMI uses ARP to find the MAC address of the default gateway and addresses the frame to it. The destination IP address remains that of the end device; the router unpacks the frame, chooses the next hop and builds a new frame. MAC addresses therefore change at every hop while IP addresses do not (except with NAT). IPv6 does not use ARP but Neighbor Discovery (RFC 4861) via ICMPv6 multicast.

🏭 What needs extra attention in industrial networks?

In industrial automation Ethernet increasingly reaches down to machine level, although Profibus and other fieldbuses are still widely used in existing plants. Industrial Ethernet places extra demands on how the network behaves:

• Real-time and determinism - standard Ethernet is best effort; jitter comes from queues in switches. VLAN priority, QoS and TSN (IEEE 802.1) make timing predictable.
• Auto-negotiation and duplex - since IEEE 802.3u (1995), two ports agree on speed and duplex automatically; for 1000BASE-T it is mandatory. If you fix one end at 100 Mbit/s full duplex and leave the other on auto, the auto side falls back to half duplex. This duplex mismatch causes late collisions on one side and FCS errors on the other, and is a classic cause of intermittent I/O.
• Broadcast load - ARP, DHCP and discovery traffic reaches every device in the VLAN. Simple field devices cope poorly with it, so keep production VLANs small.
• Network segmentation - separate zones with VLANs and firewalls in line with IEC 62443 and the Purdue Model.
• Layer 2 attacks - Ethernet and ARP have no authentication. ARP Spoofing lets an attacker intercept traffic between HMI and PLC; Dynamic ARP Inspection, port security and 802.1X limit this.

❓ Frequently asked questions

What is the difference between a MAC address and an IP address?

A MAC address is the fixed 48-bit address of a network interface and only works within a single Ethernet segment at Layer 2. An IP address is a logical Layer 3 address that you assign yourself and that enables routing between networks. For IPv4, ARP links the two addresses together.

Why does a device need a default gateway?

A device sends all traffic for destinations outside its own subnet to the default gateway, the router that knows how to reach those networks. Without a default gateway, a PLC or HMI can only reach devices in its own subnet. That is sometimes intentional, for example in an isolated machine network.

How long does a switch remember a MAC address?

A switch removes a learned MAC address from its table when no traffic from that address has passed for a certain time. IEEE 802.1D recommends 300 seconds for this, and most switches use that default. After that, traffic to the address is flooded to all ports again until the device transmits something.

Do collisions still occur on Ethernet?

On a modern switched Ethernet link in full duplex no collisions occur, because each port has its own link with separate transmit and receive paths. CSMA/CD was needed for shared coaxial cables and hubs in half duplex. Collisions you still see today usually point to a duplex mismatch.

Why does PROFINET not use IP for real-time data?

PROFINET RT places I/O data directly in an Ethernet frame with EtherType 0x8892, without an IP or TCP layer. This saves processing time in the devices and enables cycle times of a few milliseconds or less. PROFINET does use UDP/IP to set up connections and to read and write parameters, while name assignment via DCP runs directly at Layer 2, just like the real-time data.

What is the difference between a switch and a router?

A switch forwards Ethernet frames within one network based on MAC addresses at Layer 2. A router connects different IP subnets and chooses the route at Layer 3 based on IP addresses. A Layer 3 switch combines both functions in a single device.

📌 In summary

• Ethernet (IEEE 802.3) packs data into frames of 64 to 1,518 bytes with destination and source MAC address, EtherType and a CRC check
• A switch learns MAC addresses per port, forwards known addresses directly and floods unknown and broadcast frames
• For IPv4, ARP translates an IP address into a MAC address; the subnet mask decides whether traffic goes direct or via the default gateway
• In industrial networks, real-time behaviour, duplex settings, broadcast load and Layer 2 security need extra attention

Ethernet works because frames with MAC addresses are delivered within a subnet by self-learning switches, while IP, ARP and the default gateway decide how traffic leaves it. Understanding this chain lets you solve most network faults in the office and on the plant floor yourself.