Frame is (only) an envelope, a capsule (the "message" in the Data field is encapsulated). ALL messages in the network are carried in/by frames. ALL traffic is frames (cf. cars on road, (variable-sized) capsules in pneumatic tubes [hospitals, bank drive thru, Polar Express elves]).
Preamble is 7 bytes of 10101010 to electronically synchronize the clocks of the two NICs.
(Unsynchronized clocks can cause "clock slip", which is a bit error.)
SFD is 10101011 to indicate "here is the start of the frame".
(Some authors don't consider preamble and SFD as part of the frame.)
Like an envelope, a frame has destination address and source address.
Who sent the frame and who it's intended for.
Source and Destination fields are MAC addresses. Source is sender's MAC address,
Dest is recipient [whose IP address is resolved by ARP to its] MAC address.
Destination field is first so receivers can quickly determine if this frame is for it.
Every frame your computer sends has your computer's MAC address (actually, the NIC's MAC address)
in the Source field.
Every frame your computer receives has your computer's MAC address (actually, the NIC's MAC address)
in the Destination field of the received frame (or it's a broadcast frame).
Broadcast uses Dest MAC of all F's (all 48 bits are 1): FF-FF-FF-FF-FF-FF
Length is number of bytes in Data. OR is Type indicates what network layer
protocol is the payload in the Data field. i.e what kind of message the frame is carrying.
e.g. IP, IPv6, ARP, 802.1Q, STP, CDP, LLDP, and obsolete: IPX and AppleTalk.
(End of frame determinable by end of signal Inter-frame Gap (IFG), thus Length field is usually Type.)
Data field is the payload, typically an IP packet, which if <46 bytes is padded.
Frames will be different sizes depending on size of data field.
A frame carries a portion of the "message" being communicated
(but a small "message" might need only one frame).
The frame is just an envelope to encapsulate the payload
(which itself is typically an envelope...).
Every "message" sent to or recieved from the LAN is in a frame.
The Type field indicates what kind of payload is in the Data field.
Typically is either an IP packet or an ARP packet.
CRC (cyclic redundancy check) is FCS (frame check sequence) checksum
to detect error in transmission.
Sender calculates checksum on frame contents and sets the value of CRC field then sends frame,
receiver does same calculation on received contents and compares that with CRC field value, if that
differs from received checksum then most likely bit error(s) occured.
If bit errors detected at receiver, discard the frame
(drop it, throw it away, do NOTHING about it).
Ethernet: no Acknowledgements (ACK), no Negative Acknowledgements (NAK).
Inter-Packet Gap of ≥12B separates frames.
Typical Ethernet frame encapsulating an IP packet which is encapsulating a TCP segment
which is encapsulating some networking application protocol's "message/data", maybe
part of a downloading web page.
ARP protocol. IP's "little helper" to translate/resolve IP address of a host in LAN to its MAC address for Destination field of Ethernet frame. Before an IP packet can be sent, the MAC address of the destination must be determined: an ARP Request is broadcast into the LAN, asking "Who is IP address w.x.y.z?"; the host that has that IP address responds with a unicast ARP Response, saying "I am w.x.y.z and here is my MAC address"; then the sender can send the IP packet in a frame to that MAC address. The received MAC address is put into the ARP table/cache for re-use in the near future (timesout in a couple of minutes), avoiding the need for a ARP process again. ARP messages travel in the data/payload field of an Ethernet frame.
Gratuitous/Announcement ARP: broadcast new/changed IP/MAC pair to update other hosts' ARP cache.
If the IP address is of a host in another network,
ARP queries for the MAC address of the default gateway.
All communication outside a LAN goes through the default gateway (a router).
An IP packet going outside the LAN first goes
from your computer to the default gateway in a frame with your computer's MAC as
the source and the
default gateway's MAC as the destination.
That is its first step, or "hop".
From the default gateway
the IP packet is sent into the internetwork, possibly making many hops
(each hop is a router) before arriving at the IP destination.
The reply, if any, comes back to the default gateway from the internetwork
and then is put in a frame with the default gateway's MAC as the source and your MAC as the destination
(the default gateway might have first had to do an ARP Request broadcast to find out your MAC).
Your computer's only responsibility is to determine whether a packet is going to a host
in this network (in which case it sends it directly to that host)
or outside of this network (in which case it sends the packet to the default gateway).
Each end system / host doesn't need to know much (or anything) about the path a packet
takes to its destination.
arp command displays the ARP cache. (arp -a on Windows)
arp -d IPaddress (deletes an entry)