Ethernet Illustrated: MAC & LLC Sublayer Explained
It introduces MAC and LLC sublayer functions and frame structures.
Data Link Layer
According to the IEEE 802.3 standard, the Data Link Layer is divided into MAC sublayer and LLC sublayer:
Functional division and protocol stack architecture of MAC and LLC sublayers
LLC Logical Link Control sublayer Located in the upper part of Data Link Layer. It is responsible for frame synchronization, flow control, error detection and other functions, and provides a unified data‑link‑service interface for upper‑layer protocols.
MAC Media Access Control sublayer Located in the lower part of Data Link Layer. It solves media‑access problems when multiple devices share one channel. It implements media‑access mechanisms such as CSMA/CD and CSMA/CA, and provides frame addressing and error‑checking functions.
In real‑world network devices, the network adapter on PC hardware implements MAC‑layer and Physical‑layer functions. The operating‑system protocol stack implements LLC and higher‑layer protocols. For embedded devices, MAC and Physical layers may be integrated inside a single chip.
- MAC Media Access Control sublayer
The MAC sublayer is a component of the Data Link Layer. It mainly transmits data frames between network nodes and processes raw bit‑streams delivered from the Physical Layer. It provides frame encapsulation‑decapsulation, error detection, flow control and physical‑address addressing to guarantee stable operation and efficient data transmission of the Data Link Layer.
MAC packets, also known as MAC frames, are the basic transmission units of the Data Link Layer. A typical MAC frame consists of the following parts:

Preamble Used for frame synchronization.
SFD Start Frame Delimiter Marks the starting position of a frame.
Destination MAC Address MAC address of the device receiving this frame.
Source MAC Address MAC address of the device sending this frame.
Length/Type Field Indicates the length of data payload or identifies the upper‑layer protocol type.
Data and Padding The data field carries actual transmitted payload. Padding ensures the minimum valid frame length.
FCS Frame Check Sequence Used for error detection.
Take a simple MAC frame with these field contents as an example:
Preamble: 10101010 repeated 7 times SFD: 10101011 Destination Address: 00:14:22:01:23:45 Source Address: 00:16:36:29:48:01 Type Field: 0x0800 (stands for IPv4) Data: actual payload content Padding: append zero‑bytes if padding is required FCS: computed CRC checksum value
The structure of this MAC frame is shown below:
+-----------+---------+-----------------+---------------+------------+---------------------+-----+
| 10101010 | 10101011| 00:14:22:01:23:45| 00:16:36:29:48:01| 0x0800 | Actual data | CRC |
| 10101010 | | | | | (plus padding if needed)| |
| ... (7 times) | | | | | |
+-----------+---------+-----------------+---------------+------------+---------------------+-----+
Besides standard MAC frames, there are extended MAC frames for VLAN support, also called VLAN‑tagged MAC frames or IEEE 802.1Q frames. A 4‑byte QTag prefix is inserted into standard MAC frames. The QTag field sits between the source MAC address (SA) and the Ether‑Type field.
The QTag prefix contains these fields:
TPID Tag Protocol Identifier (2 bytes) Fixed value 0x8100, indicating this frame carries a QTag prefix.
TCI Tag Control Information (2 bytes)
Priority (3 bits) Defines frame priority.
CFI Canonical Format Indicator (1 bit) Normally set to 0 for Ethernet.
VLAN ID (12 bits) Identifies which VLAN this frame belongs to.
The QTag prefix contains these fields:
TPID Tag Protocol Identifier (2 bytes) Fixed value 0x8100, indicating this frame carries a QTag prefix.
TCI Tag Control Information (2 bytes)
Priority (3 bits) Defines frame priority.
CFI Canonical Format Indicator (1 bit) Normally set to 0 for Ethernet.
VLAN ID (12 bits) Identifies which VLAN this frame belongs to.
- LLC Logical Link Control sublayer
The LLC sublayer resides in the upper portion of the Data Link Layer. It provides a unified data‑link‑service interface, shields upper‑layer protocols from underlying MAC‑sublayer differences, and delivers standardized services for higher‑level protocols. Its main functions include frame encapsulation‑decapsulation, flow control, error recovery and link management. It ensures efficient and stable link operation and supports data transmission for upper‑layer protocols such as IP.
LLC frames are placed within the header area of MAC frames and include the following fields:

Analysis of LLC‑frame structure: PDU format and field functions of Logical Link Control sublayer
DSAP Destination Service Access Point Destination service‑access‑point address, indicating the target protocol for this packet.
SSAP Source Service Access Point Source service‑access‑point address, indicating the originating protocol of this packet.
Control Field Defines packet types and control information. Supported LLC frame types include Information‑frames(I‑frames), Supervisory‑frames(S‑frames) and Unnumbered‑frames(U‑frames).
information field Carries actual data payload.
