EtherType
termThe two-octet field after an Ethernet frame's addresses that names the protocol inside: 0x0800 for IPv4, 0x86DD for IPv6, 0x0806 for ARP.
Values of 0x0600 and above are types; values up to 1500 are a length, the IEEE 802.3 reading of the same field. The IEEE Registration Authority assigns them; IANA keeps a list of those the internet uses.
One field, two meanings, settled by a threshold. RFC 9542 states the rule from the internet's side: EtherTypes are 'equal to or larger than 0x0600', and a length must stay below 0x5DD 'or it could be mistaken as an EtherType'. The original DIX Ethernet used the field as a type; IEEE 802.3 first used it as a length and later accepted both readings.
The type is also how a frame announces a tag. A VLAN tag begins with 0x8100, which IANA lists as the 'Customer VLAN Tag Type (C-Tag, formerly called the Q-Tag)', and provider networks use 0x88A8 for the outer tag of a stacked pair; a receiver that finds either reads the real EtherType four octets later. LLDP is 0x88CC, and the slow protocols that carry LACP are 0x8809. When a capture shows an EtherType it cannot decode, the protocol inside is one the tool does not know, not a broken frame.
Also known as: ether type, ethernet type field, type field, 0x0800, 0x86dd, 0x0806, 0x8100