EtherType is a two-octet field in an Ethernet frame. It is used to indicate which protocol is encapsulated in the payload of an Ethernet Frame. This field was first defined by the Ethernet II framing networking standard, and later adapted for the IEEE 802.3 Ethernet networking standard.
Overview
EtherType numbering generally starts from 0x0800. In modern implementations of Ethernet, the field within the Ethernet frame used to describe the EtherType also can be used to represent the size of the payload of the Ethernet Frame. Historically, depending on the type of Ethernet framing that was in use on an Ethernet segment, both interpretations were simultaneously valid, leading to ambiguity. Ethernet v2 framing considered these octets to represent EtherType while the original IEEE 802.3 framing considered these octets to represent the size of the payload in bytes.
In order to allow packets using Ethernet v2 framing and packets using the IEEE 802.3 framing to be used on the same Ethernet segment, a unifying standard (IEEE 802.3x-1997) was introduced that required that EtherType values be greater than or equal to 1536 (0x0600). That value was chosen because the maximum length (MTU) of the data field of an Ethernet 802.3 frame was 1500 bytes (0x05DC). Thus, values of 1500 (0x05DC) and below for this field indicate that the field is used as the size of the payload of the Ethernet Frame while values of 1536 and above indicate that the field is used to represent EtherType. The interpretation of values 1501–1535, inclusive, is undefined.
The size of the payload of non-standard jumbo frames, typically ~9000 Bytes long, falls within the range used by EtherType, creating a conflict. The proposition to resolve this conflict was to substitute the special EtherType 0x8870 when a length would otherwise be used. However, the proposition was not accepted and it is defunct. The chair of IEEE 802.3 at the time, Geoff Thompson, responded to the draft outlining IEEE 802.3's official position and the reasons behind the position. The draft authors also responded to the chair's letter, but no subsequent answer from the IEEE 802.3 has been recorded. Currently, the value used for Ethertype in jumbo frames is not clear. The IEEE Registration Authority lists all the Ethertype values registered, and no reference to jumbo frames is found in the list.
With 802.1Q VLAN tagging and QinQ the sparse 16-bit EtherType is being completely used. The 16-bit EtherType not only tags the payload class, it also serves to help end any VLAN tagging or QinQ stacking. Via look-ahead peeking in streams, the 16-bit EtherType can help to confirm or package a QinQ 32+32+16=80-bit header between the 48-bit MAC addresses and the payload. Of those 80-bits only 32-bits are used for dynamic information. For a full 66-bit addressing system, 18 bits are needed beyond the MAC. Thus, additional EtherType values are required and used for Triple Tagging QinQinQ.
Inefficient and conservative use of a 16-bit Tag Protocol Identifier (TPID) on each 32-bit VLAN tag, followed by the trailing lone 16-bits creates a 48-bit signature that cannot easily be mistaken as part of the payload. Vendor implementations may avoid wasting bandwidth sending those 48-bits in proprietary link compression schemes. The EtherType usually does not contain any CRC or FCS information.
With the advent of the IEEE 802 suite of standards, a Subnetwork Access Protocol (SNAP) header combined with an IEEE 802.2 LLC header is used to transmit the EtherType of a payload for IEEE 802 networks other than Ethernet, as well as for non-IEEE networks that use the IEEE 802.2 LLC header, such as FDDI. However, for Ethernet, the Ethernet II header is still used.
Ethernet Frame. Each lower slot designates an octet. Note it does not show any Virtual LAN tags, which increase the size of the frame by 32-bits per tag. Multiprotocol Label Switching also uses 32-bits per each label (in a stacking arrangement).
Insertion of 802.1Q VLAN tag (32 bit) into Ethernet-II frame. A typical VLAN arrangement with a TPID EtherType value of 0x8100. A QinQ arrangement would add another 32-bit tag containing 16-bit TPID using various EtherType values. Triple tagging QinQinQ has three 32-bit tags besides the original 16-bit EtherType field.
Examples
EtherType for some notable protocols
Not all well known de facto uses of EtherTypes are always recorded in the IEEE list of EtherType values. For example, EtherType 0x0806 (used by ARP) appears in the IEEE list only as "Symbolics, Inc., Protocol unavailable." However, the IEEE Registration Authority lists all the accepted EtherTypes, including the 0x0806.