EtherType

What protocol the payload is.

Reading a capture

The field that selects the next layer down. This is what makes the chain self-describing rather than something the reader has to assume.

Values

Value	Meaning
0x0800	IPv4
0x0806	ARP
0x86DD	IPv6
0x888E	EAPOL — 802.1X authentication

Bit values written MSB first, matching network byte order.

Where it sits

LPDU > EtherType

• Open in the explorer — TCP over IPv4, in a protected QoS Data frame, aggregated
• Open in the explorer — Four-way handshake message 1
• Open in the explorer — Four-way handshake message 2
• Open in the explorer — Four-way handshake message 3
• Open in the explorer — Four-way handshake message 4
• Open in the explorer — ARP request in a QoS Data frame
• Open in the explorer — ICMP echo over IPv4, in a QoS Data frame
• Open in the explorer — UDP over IPv6, in a QoS Data frame
• Open in the explorer — TCP over IPv4, in a protected QoS Data frame
• Open in the explorer — TCP over IPv4, in an open QoS Data frame
• Open in the explorer — UDP over IPv4, in a QoS Data frame

Accuracy

Clause

RFC 1042

Byte order

big-endian — network byte order

Verified

Not verified against the standard. Treat this as a claim, not a fact.