The frame everything local travels in

Almost every wired local network is Ethernet, and almost every wireless one hands off to it. The frame format has barely changed since 1980.

The frame

| preamble | dest MAC | src MAC | type | payload      | CRC |
|  8 bytes |  6 bytes | 6 bytes | 2 B  | 46-1500 B    | 4 B |

MAC address: 48 bits, written as six hex pairs, burned into the interface at manufacture. The first three bytes identify the manufacturer, which is why 00:1B:44 tells you who made the card.

a4:83:e7:2f:91:0c
└──┬───┘ └──┬───┘
manufacturer  device

Type says what the payload is: 0x0800 for IPv4, 0x86DD for IPv6, 0x0806 for ARP. This is how the receiving machine knows which protocol to hand the payload to.

Minimum 46 bytes of payload, padded if necessary, for the collision detection timing described on the previous page.

MTU 1500: the maximum payload. Anything larger must be split by IP, which is where fragmentation comes from.

Broadcast and unicast

A destination of ff:ff:ff:ff:ff:ff is a broadcast and every device on the segment processes it. That is how ARP finds anybody.

The set of machines that receive a broadcast is the broadcast domain, and it matters because broadcast traffic grows with the number of devices. A flat network of several thousand machines spends real bandwidth on broadcasts, which is the main reason to split it with VLANs or routers.

MAC addresses are local only

This is the point students most often miss. A MAC address never leaves the local segment.

your laptop -> router:   dest MAC = the router
router -> next hop:      dest MAC = the next router, rewritten
...
last router -> server:   dest MAC = the server

The IP addresses stay the same the whole way. The MAC addresses are replaced at every hop, because they only ever identify the two ends of one link.