Ethernet
IEEE 802.3Ethernet is the wire’s own language. It wraps data in a frame addressed by MAC, signals it onto copper, fibre or the air, and lets each station keep only what is addressed to it — the link layer almost every network begins at.
Ethernet frames data and addresses it by MAC — the local delivery every higher layer is carried by.
How it works
Six bytes, written in hex. All ones — ff:ff:ff:ff:ff:ff — is the broadcast address every station accepts.
The EtherType says what is inside — 0x0800 for IPv4, 0x0806 for ARP, 0x86DD for IPv6 — which is how one wire carries every protocol above it.
What Ethernet does, step by step
The NIC prepends destination and source MAC addresses and an EtherType saying what the payload is.
The frame becomes voltage, light or radio on the medium, preceded by a preamble that syncs the receiver’s clock.
Each NIC checks the destination MAC and keeps only frames for its own address, or for a broadcast or subscribed multicast.
The CRC at the tail catches corruption; a good frame is stripped and its payload passed up by EtherType.
In cybersecurity
Ethernet has no authentication and no encryption — anything on the segment can be read, and a MAC address proves nothing about who sent a frame.
A NIC in promiscuous mode on a shared or mirrored port reads every frame that passes.
The source address is written by software, so it can be set to anything at all.
Flooding a switch with fake MACs can force it to broadcast, turning it back into a hub.
Port-based access control authenticates the device before it may send a single frame.
802.1AE encrypts frames hop by hop, closing the gap that plain Ethernet leaves open.
A live port in a lobby is a live port on the LAN — disable what isn’t in use.