How an Ethernet cable carries data

An Ethernet cable looks like the least interesting part of a network: a plastic jacket, a clear plug, a click. Inside, several distinct systems cooperate to turn bytes in one computer's memory into bytes in another's. This article covers typical four-pair copper twisted-pair Ethernet—the kind with RJ45 plugs—not every Ethernet variant, and is explicit about where fibre differs.

What is inside the cable

A typical cable of this kind contains eight copper wires arranged as four twisted pairs. Each pair carries a signal as the difference between its two wires, not as the voltage on one wire relative to ground.

That choice is the core trick. Interference from a nearby power cable or motor tends to push both wires of a pair by similar amounts. The receiver looks only at the difference, so much of that shared noise cancels out. Twisting keeps both wires exposed to the same interference along the run, and different twist rates between pairs reduce leakage from one pair into another.

Fibre-optic Ethernet carries light in glass instead. It avoids electrical interference entirely and supports much longer runs, but the physical encoding and hardware are completely different. Above the physical layer, the Ethernet frame looks the same.

Bits are not voltages

It is tempting to imagine "high voltage = 1, low voltage = 0". Some very old or simple links behave roughly like that, but modern Ethernet does not send one bit per voltage level.

Instead, the physical-layer chip—the PHY—groups bits and maps them onto symbols: specific signal levels or transitions sent at a fixed rate. Different Ethernet variants use different schemes. Fast Ethernet (100BASE-TX) uses two pairs, one per direction, with a three-level signalling scheme. Gigabit Ethernet (1000BASE-T) uses all four pairs in both directions at once, with five signal levels per symbol and circuitry that cancels its own transmitted signal from what it hears. IEEE 802.3 (opens in a new tab)

The point is not to memorise schemes; it is that "bits per second" and "symbols per second" differ, and the mapping between them is a design decision for each speed. Compliance measurements on these signals—amplitude, rise time, templates—are what PHY test procedures check. Texas Instruments PHY compliance note (opens in a new tab)

PHY and MAC: two jobs

A network interface has two main parts.

The PHY deals with the medium: encoding, signal levels, clock recovery, detecting whether a link exists, and negotiating speed with the other end.

The MAC (media access control) deals with frames: adding addresses, computing checks, and handing complete frames to and from the computer's memory. The PHY moves symbols; the MAC moves frames.

What a frame contains

A common Ethernet II frame carries a destination MAC address, a source MAC address, a type field saying what is inside, the payload, and a frame check sequence—a CRC calculated over the frame. (In the older IEEE 802.3 length format, that same field holds the payload length instead.)

The payload is often an IP packet, but Ethernet does not know or care. IP addresses identify hosts across networks and are used by routers; MAC addresses identify interfaces on the local link and are used by switches. An IP packet crossing the internet may travel over many kinds of link—Ethernet, Wi-Fi, fibre, cellular—and gets a fresh link-layer frame on each one. Its IP source and destination are normally preserved end to end, although network address translation (NAT) can rewrite them.

Switching

A switch receives a frame on one port and decides where to send it. It learns which MAC addresses live behind which ports by watching source addresses, then forwards frames only toward the right port. If it does not yet know a unicast destination, it floods the frame to the eligible ports in that VLAN, except the one it arrived on. With full-duplex links between hosts and switch ports, devices can send and receive at the same time without the collisions early shared Ethernet had to manage.

Detecting errors is not fixing them

The receiving MAC recalculates the CRC over the arriving frame. If it does not match, the frame is corrupted and is discarded. A CRC detects many kinds of corruption, though not every possible one. A store-and-forward switch checks it before forwarding; a cut-through switch can start forwarding before the whole frame, and therefore its CRC, has arrived.

The CRC itself does not repair a frame or ask for it again. (Some faster Ethernet PHYs add forward error correction, which can correct certain bit errors below the frame level—so "Ethernet never repairs anything" would be too strong.) Recovery from a dropped frame, if any, happens higher up. TCP notices missing data and retransmits it. Protocols built on UDP may tolerate loss, or implement their own recovery. A slightly damaged cable can therefore show up not as a visible error, but as a connection that is mysteriously slow—because higher layers keep retransmitting.

Following one byte

Trace one byte of a web request over HTTP/1.1 or HTTP/2, which run on TCP. (HTTP/3 uses QUIC over UDP instead.) Software writes the byte to a socket. The operating system wraps it in TCP and IP headers. The network interface's MAC adds an Ethernet header and CRC. The PHY encodes the frame into symbols across the pairs. A store-and-forward switch receives it, checks the CRC, looks up the destination MAC and forwards it. The receiving MAC checks the CRC again, and the operating system unwraps the layers until the byte reaches the waiting program.

Every stage is a place where time can be spent and data can be dropped. For how the receiving computer handles that data, see why fast code still waits; for memory and buffers, see memory and data movement.