EtherType Values Lookup
Quick EtherType lookup for Ethernet II frames. Learn common EtherType values including 0x0800 IPv4, 0x0806 ARP, 0x86DD IPv6, and 0x8100 VLAN tagging.
Protocol Overview
Ethernet II Frame Format (IEEE 802.3)
Common EtherType Values
In an Ethernet II frame, the two bytes after the source MAC address are the EtherType field. Values greater than or equal to 0x0600 identify the protocol carried by the payload. Use this table as a quick EtherType lookup when reading captured frame hex.
| EtherType | Meaning | Payload | Notes |
|---|---|---|---|
| 0x0800 | IPv4 | Internet Protocol version 4 | The payload starts with an IPv4 header, commonly beginning with version/IHL byte 0x45. |
| 0x0806 | ARP | Address Resolution Protocol | Used on local networks to map IPv4 addresses to MAC addresses. |
| 0x86DD | IPv6 | Internet Protocol version 6 | The payload starts with the fixed 40-byte IPv6 base header. |
| 0x8100 | 802.1Q VLAN | VLAN tag follows | The next 4 bytes contain the VLAN tag; the inner EtherType appears after that tag. |
How to Read EtherType in a Frame
Start at byte 12 of an Ethernet II frame. Bytes 0-5 are the destination MAC address, bytes 6-11 are the source MAC address, and bytes 12-13 hold the EtherType. For example, an EtherType of 0x0800 means the next bytes should be decoded as an IPv4 packet.
VLAN-tagged traffic is the important exception. When the outer EtherType is 0x8100, the next four bytes are the 802.1Q tag. The actual payload type is stored in the two bytes after that tag, so a VLAN frame carrying IPv4 often appears as 0x8100 followed later by 0x0800.
Header Fields
| Field | Offset | Size | Type | Description |
|---|---|---|---|---|
Destination MAC dest_mac | 0 bits | 48 bits | uint64mac | Destination MAC address (6 bytes) |
Source MAC source_mac | 48 bits | 48 bits | uint64mac | Source MAC address (6 bytes) |
EtherType ethertype | 96 bits | 16 bits | uint16hex | Protocol type of payload Known values: 2048=IPv4 (0x0800), 2054=ARP (0x0806), 33024=802.1Q VLAN (0x8100), 34525=IPv6 (0x86DD) |
Common Ethernet Mistakes
- 1Confusing Ethernet II (EtherType ≥ 1536) with IEEE 802.3 (Length ≤ 1500)
- 2Forgetting that MAC addresses are 48 bits (6 bytes), not 32 or 64
- 3Misreading byte order: MAC addresses are typically shown in big-endian (network order)
- 4Not accounting for the 4-byte FCS (Frame Check Sequence) at the end
- 5Assuming all frames have a payload (minimum frame size is 64 bytes including FCS)