How does Ethernet work step by step when you plug in a network cable?

When an Ethernet cable is plugged in, the two PHYs first perform IEEE 802.3 auto-negotiation using Fast Link Pulses (FLP) to select 1000BASE-T full duplex and train PAM-5 equalizers and echo cancellers. Next, the client runs DHCP (Discover, Offer, Request, ACK) to obtain its IPv4 address, subnet mask, and default gateway, followed by RFC 5227 ARP probes and announcements. Before sending the TCP SYN, the client resolves the default gateway MAC via ARP, the router resolves the destination server MAC on the target subnet, the three-way TCP handshake (SYN, SYN+ACK, ACK) completes, and the application transmits its PSH+ACK data segment.

What fields in an Ethernet frame and IPv4 packet change across switches and routers?

An 802.1Q VLAN switch inserts or strips the 4-byte 0x8100 VLAN tag when moving frames between access ports and trunk links, adjusts Ethernet minimum padding if needed, and recomputes the 4-byte CRC-32 Frame Check Sequence (FCS) while leaving MAC addresses and IPv4 headers untouched. An IPv4 router replaces both source and destination Ethernet MAC addresses with the next-hop link endpoints, decrements the IPv4 TTL by 1, recomputes the IPv4 header checksum, and generates a new Ethernet FCS while leaving the IPv4 addresses and TCP segment bit-for-bit identical.

How are Ethernet CRC-32 FCS and IPv4, UDP, and TCP checksums calculated on the wire?

Every Ethernet II frame ends with a 4-byte Frame Check Sequence (FCS) computed using the reflected IEEE 802.3 CRC-32 polynomial (0xEDB88320) over all bytes from Destination MAC through payload and padding (excluding the 7-byte preamble and 1-byte SFD 0xD5). IPv4 headers, UDP datagrams, and TCP segments use 16-bit ones-complement checksums.

$ ./plug-in-to-tcp --step-by-step

How Ethernet Works: from plug-in to TCP, every frame on the wire

This interactive walkthrough explains how Ethernet works step by step, from 1000BASE-T PHY auto-negotiation through DHCP, ARP, 802.1Q VLAN switching, the IPv4 router, and the TCP three-way handshake to the first data segment. Every frame below is built byte by byte, and the IP, UDP and TCP checksums and the Ethernet FCS are computed live from the bytes shown. Tap a link in the network to see the frame as it looks on that cable.

Network · tap a link to choose which cable you look at

How Ethernet Works Step by Step: PHY Auto-Negotiation, 802.1Q VLAN, DHCP, ARP, IPv4 Routing, and TCP Handshake

Understand how Ethernet works on the physical wire and across switches and routers by inspecting every Ethernet II frame byte by byte: 1000BASE-T Fast Link Pulses (FLP) and PAM-5 link training, DHCP Discover Offer Request ACK (DORA), ARP probes and gratuitous announcements (RFC 5227), default gateway ARP resolution, 802.1Q VLAN tagging (0x8100), router MAC rewrite, TTL decrement and IPv4 header checksum recalculation, the TCP three-way handshake (SYN, SYN+ACK, ACK), PSH+ACK application payload delivery, and live IEEE 802.3 CRC-32 FCS verification.