# Confusions regarding byte and bit ordering of Ethernet Frame

I understand the concept of Endianess regarding numbers because there the bit significance is well defined. But when applied to things like Ethernet frame or Mac address, things are so clear to me, because here we have only a sequence of bits, not a number. Yet terms like first byte, most significance byte or network byte ordering get thrown around without clarification.

My question actually composes of several but related questions, because I can't think of a better way to formulate it:

1. How is byte significance defined for an Ethernet frame? Does we count the byte starting from the MAC destination the most significance byte? I think that should be the case because I read that network byte ordering is big Endian, so the most significance byte gets transmitted first, which should be the MAC destination address.

2. How is byte significance defined for MAC address? Given a MAC address written as 00-14-22-01-23-45 , then I assume going from most significant byte to least significant byte is going from left to right? What counts as the first byte? If we say the first of something, does it mean we say the most significant of something?

3. If my computer is using Little Endian and the above Mac address is stored in the memory, then if my assumption is right, the memory offset 0x00 should store 45, because that's what Little Endian means, am I right?

4. Now if the above address is transmitted over the wire, because of Big-Endian, the memory offset 0x05 gets transmitted first, because it stores the most signicant byte of the address? That seems a little weird for me because I initially thought that we just transmit sequentially from the lowest memory offset to the highest memory offset.

5. When it comes to transmitting a bit within a byte, we should have two options: we transmit the least significant bit first, or the most transmit the most significant bit first. So shouldn't bit endianess play a role here?

6. How does the header look like at the recieving end? Does the recieving computer just store the first byte it received at the lowest memory address and so on and so forth, or does it know about byte significance automatically flip the bytes around? For example in this case if the first byte it recieved is 0x45, then does it store the value at 0x00, or knowing 0x45 should be the most signifant byte, automatically store the value at 0x05? ( Assuming the recieving end also uses little endian)

## 2 Answers

Check IEEE 802.3 Clause 3:

• Each octet is transmitted least significant bit (LSB) first (right to left in normal writing order). (3.2.3)
• For multi-octet/bytes fields, the most significant octet is transmitted first (big-endian or left to right in normal writing order). (3.2.6)

Little-endian computers may store a MAC address in memory in their native, least-significant-octet-first format when using an internal representation, or in Ethernet's most-significant-octet-first format when it comes to encoding or decoding an Ethernet frame - using the correct format is the responsibility of the programmer and the API.

Of course, the byte order needs to be reversed in between formats - that can be done by the (low-level) application, the API, the OS stack, the NIC driver or even the NIC hardware.

• I want to make sure I understand this correctly : regardless of how a computer stores it, when we write down a MAC address on paper, we implicitly assume the leftest byte we write is the most significant byte? When I use a tool like Wireshark to sniff the pakets, the memory offset 0x00 is always the first byte in that frame ( MSB), regardless of the endianess of my computer?
– Gnut
Jun 17, 2019 at 18:02
• In (human) written form, the MAC address is most significant octet first, just like the transmission order. Storage in little-endian memory and applications varies - Wireshark displays the transmission order though.
– Zac67
Jun 17, 2019 at 18:33

You need to understand that there are several standards bodies involved, and that ethernet MAC addressing is generally handled by the hardware, and it is up to the hardware to serialize the bytes and bits in the proper order for the physical medium used.

When ethernet was created, it used most-significant-byte ordering, but least-significant-bit ordering within the bytes (the least-significant-bit of the most-significant-byte is transmitted first). Contrast that to token ring that uses most-significant-bit ordering within the bytes. The physical and data-link protocols are determined by standards bodies, such as the IEEE (ethernet, token ring, FDDI, Wi-Fi, etc.). Even within a standards body, the protocols can vary because they were independently created by different people at different times.

Do not confuse the physical and data-link protocol standards with the IETF standards, which say that data is transmitted most-significant-byte first, and where possible, most-significant-bit first:

3.2. Network Bit Order

For certain low-level protocols or compression-oriented media types, bit-order may be an issue. When possible, big-endian is encouraged for consistancy with Network Byte Order.

The IETF generally creates the standards for protocols in the network (IPv4 and IPv6) and transport layers (TCP, UDP, etc.), as well as some application-layer protocols.

How a particular host (processor, OS, etc.) handles the byte and bit order is off-topic here. In general, programming libraries handle the problem for your particular host, but that, too, is off-topic here, and you could try to ask about the programming aspect on Stack Overflow.

• Saying data is transmited most significant byte first is not really illuminating because data is not a number, it has by itself no concept of bit significance. But Zac67 has pointed out that it is transmited in normal left to right order, and I assume that we always define the first byte we write is the most significant so that clears up some confusion for me.
– Gnut
Jun 17, 2019 at 18:15
• @SeifeUndSalz Binary data is composed of numbers - or rather, binaries, hexadecimals, decimals, alphas, symbols, even web pages, or pictures are just representations of groups of bits.
– Zac67
Jun 17, 2019 at 18:47
• I mean you can represent data as a number, but if you have several numbers, you need to define which number is more significant. Like I can say the first byte (in the order I write it) in the header of an Ethernet frame is the least significant byte. So according to Big Endian, the header get transmitted last, which is not the case here.
– Gnut
Jun 17, 2019 at 19:11
• @SeifeUndSalz, if you write the MAC address from left-to-right, then the first byte you write is the most significant byte (transmitted first), and the leftmost bit is the most significant bit (transmitted last in the byte). I think you are trying too hard or overthinking it. Jun 17, 2019 at 19:17
• @RonMaupin right, that implicit assumption is what I am trying to ask :) I'm doing a homework in which I have p as a pointer to the recieved Ethernet frame, and I need to check if it has multicast address or not. So I need to know exactly which bit in the buffer I need to check, which can be either *p | 0x01 or *(p+5) | 0x01, that leads me to the question here.
– Gnut
Jun 17, 2019 at 21:01