EtherType

EtherType is a two-octet field in an Ethernet frame. It is used to indicate which protocol is encapsulated in the payload of an Ethernet Frame. This field was first defined by the Ethernet II framing networking standard, and later adapted for the IEEE 802.3 Ethernet networking standard.

EtherType numbering generally starts from 0x0800. In modern implementations of Ethernet, the field within the Ethernet frame used to describe the EtherType also can be used to represent the size of the payload of the Ethernet Frame. Historically, depending on the type of Ethernet framing that was in use on an Ethernet segment, both interpretations were simultaneously valid, leading to ambiguity. Ethernet v2 framing considered these octets to represent EtherType while the original IEEE 802.3 framing considered these octets to represent the size of the payload in bytes. In order to allow packets using Ethernet v2 framing and packets using the IEEE 802.3 framing to be used on the same Ethernet segment, a unifying standard (IEEE 802.3x-1997) was introduced that required that EtherType values be greater than or equal to 1536 (0x0600). That value was chosen because the maximum length (MTU) of the data field of an Ethernet 802.3 frame was 1500 bytes (0x05DC). Thus, values of 1500 (0x05DC) and below for this field indicate that the field is used as the size of the payload of the Ethernet Frame while values of 1536 and above indicate that the field is used to represent EtherType. The interpretation of values between 1500 and 1536, exclusive, is undefined. The size of the payload of non-standard jumbo frames, typically ~9000 Bytes long, falls within the range used by EtherType; this conflict is resolved by substituting the special EtherType value 0x8870 when a length would otherwise be used. The network stack can replace this special EtherType with the actual length of the packet on receive, or when bridging to non-Ethernet networks like FDDI.

With 802.1q VLAN Tagging and QinQ the sparse 16-bit EtherType is being completely used. The 16-bit EtherType not only tags the payload class, it also serves to help end any VLAN Tagging or QinQ stacking. Via look-ahead peeking in streams, the 16-bit EtherType can help to confirm or package a QinQ 32+32+16=80 bit Header between the 48-bit MAC addresses and the payload. Of those 80-bits only 32-bits are used for dynamic information. For a full 66-bit addressing system, 18 bits are needed beyond the MAC. Thus, additional EtherType values are required and used for Triple Tagging QinQinQ. Inefficient and conservative use of a 16-bit Tag Protocol Identifier (TPID) on each 32-bit VLAN Tag, followed by the trailing lone 16-bits creates a 48-bit Signature that can not easily be mistaken as part of the payload. Vendor implementations may avoid wasting band-width sending those 48-bits in proprietary link compression schemes. The EtherType is not expected to contain any CRC or FCS information.

With the advent of the IEEE 802 suite of standards, a SNAP header combined with an IEEE 802.2 LLC header is used to transmit the EtherType of a payload for IEEE 802 networks other than Ethernet, as well as for non-IEEE networks that use the IEEE 802.2 LLC header, such as FDDI. However, for Ethernet, the Ethernet II header is still used.

Note that even very well known de facto uses of EtherTypes are not always recorded in the IEEE list of EtherType values. For example, EtherType 0x0806 (used by ARP) appears in the IEEE list only as "Symbolics, Inc., Protocol unavailable."