Networking Basics     Network Hardware     Network Topology     Networking Protocols     Ethernet  

Ethernet frame types and the Ether Type field

Frames are the format of data packets on the wire.

There are several types of Ethernet frame:

  1. Original Ethernet Version I (no longer used)
  2. The Ethernet Version 2 or Ethernet II frame, the so-called DIX frame (named after DEC, Intel, and Xerox), this is the most common today, as it is often used directly by the Internet Protocol.
  3. Novell’s homegrown Variation of IEEE 802.3 (“raw 802.3 frame”) without LLC
  4. IEEE 802.2 LLC frame
  5. IEEE 802.2 LLC/SNAP frame

In addition, Ethernet frames may optionally contain a IEEE 802.1Q tag to identify what VLAN it belongs to and its IEEE 802.1p priority (quality of service). This doubles the potential number of frame types.

The different frame types have different formats and MTU values, but can coexist on the same physical medium.

The original Xerox Version 1 Ethernet had a 16 bit length field, although the maximum length of a packet was 1500 bytes. This length field was soon re-used in Xerox’s Version 2 Ethernet as a label field, with the convention that values between 0 and 1500 indicated the use of the original Ethernet format, but higher values indicated what became known as an Ether Type, and the use of the new frame format. This is now supported in the IEEE 802 protocols using the SNAP header.

Ether Type


0x0800 IP Internet Protocol (IPv4)
0x0806 Address Resolution Protocol (ARP)
0x8035 Reverse Address Resolution Protocol (RARP)
0x809b AppleTalk (Ethertalk)
0x80f3 Appletalk Address Resolution Protocol (AARP)
0x8100 (identifies IEEE 802.1Q tag)
0x8137 Novell IPX (alt)
0x8138 Novell
0x86DD Internet Protocol, Version 6 (IPv6)
0x8847 MPLS unicast
0x8848 MPLS multicast
0x8863 PPPoE Discovery Stage
0x8864 PPPoE Session Stage

Type field (EtherType) for some common protocols

IEEE 802.2 defined the 16 bit field after the MAC addresses as a length field again. As Ethernet I framing is no longer used, this allows software to determine whether a frame is an Ethernet II frame or an IEEE 802.2 frame, allowing the coexistence of both standards on the same physical medium. All 802.2 frames have a logical link control (LLC) header. By examining this header, it is possible to determine whether it is followed by a SNAP (subnetwork access protocol) header. (Some protocols, particularly those designed for the OSI networking stack, operate directly on top of 802.2 LLC, which provides both datagram and connection-oriented network services.) The LLC header includes two additional eight-bit address fields (called service access points or SAPs in OSI terminology); when both source and destination SAP are set to the value 0xAA, the SNAP service is requested.

Novell’s “raw” 802.3 frame format was based on early IEEE 802.3 work. Novell used this as a starting point to create the first implementation of its own IPX Network Protocol over Ethernet. They did not use any LLC header but started the IPX packet directly after the length field. In principle this is not interoperable with the other later variants of 802.x Ethernet, but since IPX has always FF at the first byte (while LLC has not), this mostly coexists on the wire with other Ethernet implementations (with the notable exception of some early forms of DECnet which got confused by this).

Novell Netware used this frame type by default until the mid nineties, and since Netware was very widespread back then (while IP was not) at some point in time most of the world’s Ethernet traffic ran over “raw” 802.3 carrying IPX. Since Netware 4.10 Netware now defaults to IEEE 802.2 with LLC (Netware Frame Type Ethernet_802.2) when using IPX. There is a classic series of Usenet postings by Novell’s Don Provan that have found their way into numerous FAQ’s and are widely considered the definitive answer to the Novell Frame Type jungle.

Mac OS uses 802.2/SNAP framing for the AppleTalk protocol suite on Ethernet (“EtherTalk”) and Ethernet 2 framing for TCP/IP.

The 802.2 variants of Ethernet are not in widespread use on common networks currently, with the exception of large corporate Netware installations that have not yet migrated to Netware over IP. In the past, many corporate networks supported 802.2 Ethernet to support transparent translating bridges between Ethernet and IEEE 802.5 Token Ring or FDDI networks. The most common framing type used today is Ethernet Version 2, as it is used by most Internet Protocol-based networks, with its EtherType set to 0x0800.

There exists an Internet standard () for encapsulating IP version 4 traffic in IEEE 802.2 frames with LLC/SNAP headers. It is almost never implemented on Ethernet (although it is used on Token Ring and FDDI networks). IP traffic can not be encapsulated in IEEE 802.2 LLC frames without SNAP because, although there is an LLC protocol type for IP, there is no LLC protocol type for ARP. IP Version 6 over Ethernet is also standardized based on IEEE 802.2 with LLC/SNAP.

The IEEE 802.1Q tag, if present, is placed between the Source Address and the EtherType or Length fields. The first two bytes of the tag are the Tag Protocol Identifier (TPID) value of 0x8100. This is located in the same place as the EtherType/Length field in untagged frames, so an EtherType value of 0x8100 means the frame is tagged, and the true EtherType/Length is located after the tag. The TPID is followed by two bytes containing the Tag Control Information (TCI) (the IEEE 802.1p priority (quality of service) and VLAN id). The tag is followed by the rest of the frame, using one of the types described above.


Leave a Comment