Ethertype Explained: A Comprehensive Guide to the EtherType Field and Its Everyday Impact on Networking
In the vast landscape of computer networking, certain terms become almost invisible to the everyday user, yet they quietly power every data exchange. The Ethertype field is one such essential component in Ethernet frames. It identifies what kind of payload sits inside a frame, guiding network devices on how to interpret and deliver data. This article offers a thorough, reader-friendly exploration of Ethertype, its purpose, its practical uses, and its place in both traditional networks and modern, evolving deployments.
What is Ethertype and why does it matter?
Ethertype (also seen as EtherType in many documents) is a two-byte field found in the payload header of Ethernet frames. It serves as a type indicator, signalling the protocol carried by the frame’s payload. When a device on the local network receives a frame, it reads the Ethertype to determine whether the frame contains IPv4 data, IPv6, ARP information, or something else entirely. Think of Ethertype as a postal stamp: it tells the recipient what kind of envelope has arrived and how to open it.
Historically, Ethertype sits after the Ethernet header’s MAC destination and source addresses and the length/type field, depending on the frame’s format. In classic Ethernet frames (IEEE 802.3), this field can denote either a length of the payload when the value is less than or equal to a defined threshold, or an Ethertype when the value indicates a higher-layer protocol. The common threshold is 1536 bytes (0x0600 in hexadecimal). If the value exceeds this threshold, it is treated as Ethertype; otherwise, it indicates the payload length. This nuance is important for network engineers when diagnosing frames and parsing traffic captures.
Ethertype versus Length: understanding the distinction
In the early days of Ethernet, the boundary between length and type was the same two-byte field. Over time, the distinction became clearer and more standardised. Today, Ethertype is used to designate the protocol directly, while a length value indicates the number of payload bytes following the field. Modern Ethernet frames that carry higher-layer protocol data rely on Ethertype values to identify IPv4, IPv6, ARP, and more. As a result, a single field performs dual roles depending on the value it carries, which is why accurate interpretation is essential for packet analysis and network troubleshooting.
To keep things practical: if you see a value in the Type/Length field greater than 0x0600 (1536 decimal) in a capture, the frame uses Ethertype to signal the upper-layer protocol. If you see a value of 0x05DC (1500 decimal) or smaller, that value represents the payload length for the 802.3 frame rather than a protocol identifier. Tools like Wireshark handle these nuances automatically, but it helps to understand the underlying rule when interpreting raw traces.
How Ethertype is used in Ethernet frames
Ethertype is embedded in Ethernet frames to denote the protocol of the encapsulated payload. This mechanism is essential for frame parsing by switches, routers, and host devices. When a Nexus switch examines a frame bearing Ethertype 0x0800, it forwards the frame to an IPv4 layer or routes it accordingly. A frame with Ethertype 0x86DD is IPv6, guiding the recipient to the IPv6 stack. Other Ethertype values map to a wide array of protocols, from ARP (0x0806) to more specialised or vendor-specific data formats.
In practice, Ethertype is part of the header that helps network devices decide how to hand the data to the correct upper-layer protocol. Because Ethernet is a universal media access method, the Ethertype field acts as a simple, portable protocol declaration that travels with the frame end-to-end within a local network segment. This simplicity is powerful: it enables fast processing by network devices and consistent interpretation across disparate vendor implementations.
Common Ethertype values you are likely to encounter
The list of Ethertype values is long, reflecting the broad ecosystem of internet protocols and alternative services. Here are some of the most frequently seen Ethertype values and what they represent. Knowing these can be incredibly helpful for network troubleshooting, performance tuning, and security assessments.
IPv4 and IPv6: the core network protocols
- 0x0800 — IPv4: The most common Ethertype on traditional IPv4 networks. Frames with this Ethertype carry IPv4 packets (IP version 4).
- 0x86DD — IPv6: The modern successor to IPv4, used for internet routing with IPv6 addresses. Frames with this Ethertype encapsulate IPv6 packets.
Address resolution and related protocols
- 0x0806 — ARP: Address Resolution Protocol. Used for mapping network addresses (like IPv4 addresses) to MAC addresses on a local network.
- 0x8035 — RARP: Reverse Address Resolution Protocol. Less common today, but historically used to map MAC addresses to IPv4 addresses.
Local network management and neighbour discovery
- 0x0842 — Wake-on-LAN (WOL) and other vendor-specific uses sometimes appear in practice, though this is often encapsulated in other fields or protocols.
- 0x6558 — Link Layer Discovery Protocol (LLDP) and related vendor protocols may appear with specific Ethertype values in special deployments.
VLAN tagging and network segmentation
- 0x8100 — 802.1Q VLAN tagging: This Ethertype denotes a VLAN tag that is inserted into frames to support network segmentation. Frames with this Ethertype carry VLAN metadata before the payload.
- 0x88A8 — 802.1ad QinQ: Stacking VLAN tags for additional segmentation, often used in service provider networks.
MPLS and other encapsulations
- 0x8847 — MPLS unicast: Multi-Protocol Label Switching. MPLS labels used for efficient packet forwarding in service provider networks.
- 0x8848 — MPLS multicast: MPLS with multicast label semantics, used in certain deployment scenarios.
Other notable Ethertype values
- 0x884C — PPPoE Discovery: Point-to-Point Protocol over Ethernet discovery stage, used in some broadband access methods.
- 0x8870 — JUMBO frames or vendor-specific implementations in some contexts.
- 0x8846 — PPPoE Session: PPPoE session stage in specific environments.
Above all, Ethertype values matter because they define how devices interpret the payload. Some deployments rely heavily on IPv6, while others are still anchored in IPv4. In data centre environments, MPLS Ethertype values may be prevalent, whereas campus networks might see more VLAN-tagged frames indicated by 0x8100. When planning a network, understanding Ethertype allows engineers to predict how traffic will be processed by switches and routers as it enters the core network.
Practical examples: reading Ethertype in traffic captures
Capturing network traffic with tools such as Wireshark or tcpdump is a practical way to become fluent with Ethertype values. When you inspect a captured frame, the Ethertype or length field is one of the first clues about what the frame carries. Here are some common scenarios and how to interpret them.
Example: IPv4 frame in a LAN
In a captured Ethernet frame, you might see a Type/Length field with the value 0x0800. This indicates an IPv4 payload. In the IPv4 header that follows, you will see the typical IP version, header length, total length, protocol, and source/destination addresses. This sequence confirms that the frame is carrying an IPv4 packet destined for a particular host on the LAN.
Example: VLAN-tagged traffic
For frames with 0x8100 as the Ethertype, the frame includes a VLAN tag immediately following the source MAC address. The VLAN tag contains the VLAN ID and priority (often called 802.1Q tagging). After the VLAN tag, you will observe the next Ethertype, such as 0x0800 for IPv4 or 0x86DD for IPv6. This separation allows network devices to apply policies based on VLAN while still delivering the underlying IP payload correctly.
Example: MPLS in service provider networks
In MPLS deployments, you may see Ethertype 0x8847 or 0x8848. The MPLS label stack sits between the Ethernet header and the IP or other payload. This arrangement enables fast-forwarding decisions in core routers and can be crucial for performance and traffic engineering. When troubleshooting MPLS paths, Ethertype helps identify where the MPLS labels begin and end within a frame.
Reading Ethertype in practice: quick tips
- Use a robust packet analyser to automatically decode Ethertype and subsequent layers; this reduces manual decoding effort and minimizes errors.
- When diagnosing network issues, note Ethertype values first to determine whether the problem is at the data link layer or higher up in the protocol stack.
- Be aware that some vendors implement non-standard or vendor-specific Ethertype values for proprietary protocols or tunnel encapsulations. Always consult documentation for those implementations.
Ethertype and network security: considerations and best practices
Ethertype plays a role in security in several ways. Understanding the Ethertype field helps in anomaly detection, traffic shaping, and the enforcement of access controls. Misconfigurations or unexpected Ethertype values can indicate misrouted frames, mislabelled VLANs, or malicious activity attempting to masquerade as legitimate traffic. Here are some security-focused considerations related to Ethertype:
- Detection of spoofed frames: Anomalous Ethertype values or unexpected transitions between VLANs can indicate spoofing attempts or misconfigurations. Regular monitoring helps catch these issues early.
- Segmentation awareness: Ethertype 0x8100 indicates VLAN tagging; if a network lacks proper segmentation, untagged frames may be misinterpreted by devices downstream. Implement consistent tagging policies to minimise risk.
- Secure MPLS deployments: In networks that rely on MPLS, properly handling Ethertype 0x8847/0x8848 and ensuring label stacks are validated helps protect against misrouting and label spoofing.
- Policy enforcement: Firewall and IDS rules often inspect Ethertype to determine which traffic to scrutinise. Having a clear understanding of expected Ethertype distributions supports accurate rule sets.
Historical development and the role of Ethertype in Ethernet standards
The Ethertype concept emerged as Ethernet networks evolved from simple frame formats into layered networks capable of carrying diverse protocols. As the internet grew, the need for a clean, scalable method to identify higher-layer protocols became apparent. The Ethertype field provided that mechanism, enabling seamless interoperability across hardware vendors and software platforms. Over time, the Ethernet standardisations—particularly IEEE 802.3 and 802.1Q—embedded and regularised Ethertype usage within frame structures. This historical evolution underpins modern network design, where the Ethertype field continues to withstand the test of time even as network speeds and topologies expand.
Future directions: where Ethertype fits in modern and next-generation networks
While Ethertype remains a robust mechanism for protocol identification, the networking landscape is evolving with software-defined networking (SDN), network function virtualisation (NFV), and increasingly complex data fabrics. In these environments, Ethertype still serves as a reliable anchor at the data link layer, while additional encapsulation methods (such as VXLAN, Geneve, and other tunneling protocols) coexist to support overlay networks. Ethertype’s role may become more compartmentalised within specific overlay or underlay designs, but its fundamental function—identifying the payload’s type—remains indispensable. For network engineers, a strong grasp of Ethertype and its typical values is still one of the most valuable foundational skills.
Common pitfalls: things to watch out for with Ethertype
Despite its simplicity, there are a few pitfalls that can complicate working with Ethertype in real networks. Being aware of these helps engineers avoid misinterpretation and misconfiguration:
- Misinterpreting lengths as Ethertype: Always verify whether the frame uses 802.3 length or actual Ethertype to avoid misrouted or misinterpreted frames.
- Overlooking VLAN-induced Ethertype transitions: VLAN tagging can shift the position of the payload, so ensure you examine the frame structure carefully when troubleshooting.
- Vendor-specific Ethertype usage: Some devices use proprietary Ethertype values for special services; consult vendor documentation to ensure proper interpretation.
- Tunnel and overlay encapsulations: In modern networks, Ethertype can indicate an outer encapsulation (such as an IP-in-IP tunnel) rather than the inner payload—follow the decoding chain to reveal the actual data.
Ethertype in practice: a quick reference for networking professionals
For engineers, having a practical reference can speed up analysis and troubleshooting. Here is a concise, handy summary of Ethertype concepts to keep in the toolkit:
- Ethertype is a two-byte field used to indicate the payload protocol in Ethernet frames.
- Common Ethertype values include 0x0800 for IPv4, 0x86DD for IPv6, 0x0806 for ARP, 0x8100 for 802.1Q VLAN tagging, 0x8847/0x8848 for MPLS, and others.
- The threshold between length and Ethertype is 0x0600; values above indicate Ethertype, while values at or below signify length.
- In modern networks, Ethertype often appears alongside VLAN tags and MPLS labels; ensure you decode in the correct order to reveal the actual payload.
- When auditing security or performance, log and analyse Ethertype distributions to spot anomalies or misconfigurations quickly.
Frequently asked questions about Ethertype
Below are answers to common questions that technicians, engineers, and curious readers often ask about Ethertype. This section is designed to be a quick-reference guide that complements the deeper explanations above.
What does Ethertype stand for?
Ethertype is the widely used term for the protocol type indicator carried in Ethernet frames. Some documentation also uses EtherType as an alternative spelling; both refer to the same concept.
Why is Ethertype important in Ethernet frames?
Because it tells the network stack what protocol the payload belongs to. Without Ethertype, a receiving device would struggle to determine whether a frame carries IPv4, IPv6, ARP, or another protocol, leading to failed deliveries or misinterpretations.
Is Ethertype always required in Ethernet frames?
In most modern Ethernet frames, the Ethertype field is present and used to mark the payload type. In some older or specialised frames, the Type/Length field’s interpretation can vary, so it’s worth understanding the specific network context.
How can I identify Ethertype in a capture quickly?
Use a packet analyser or a network monitoring tool to display the Ethertype value in hexadecimal alongside the protocol interpretation. In Wireshark, for example, the Ethertype is shown immediately in the Ethernet II header, followed by a decoded tree for the corresponding protocol.
Summary: Ethertype as a cornerstone of Ethernet data framing
Ethertype is more than just a two-byte label; it is a fundamental shaping force in how Ethernet frames are interpreted and routed across networks. From IPv4 and IPv6 to VLANs and MPLS, Ethertype values unlock the ability of devices to understand, process, and forward data accurately and efficiently. The field’s enduring relevance, even as networks become more virtualised and diverse, makes Ethertype a core topic for anyone looking to understand, design, or troubleshoot Ethernet networks in the UK and beyond.
Further reading and practical exercises
To deepen your understanding of Ethertype, consider these practical activities and resources:
- Capture and inspect traffic on a local network to identify common Ethertype values and correlate them with the observed protocols.
- Experiment with VLAN tagging in a lab environment and observe how Ethertype values propagate before and after the VLAN tag.
- Study MPLS-enabled traffic in a controlled setting to see how Ethertype interacts with label stacks and forwarding decisions.
Closing thoughts: mastering Ethertype for robust network design
Ethertype might be a small two-byte field, yet its impact on network operation is substantial. By understanding Ethertype, network professionals gain a clearer lens for viewing frames, diagnosing problems, and designing resilient, scalable networks. In practice, the best way to become fluent with Ethertype is to observe real traffic, decode layer by layer, and connect the dots between the two-byte type indicator and the higher-layer protocols that drive today’s digital communication.