Identifying Ethernet Header Types

There are 3 different Ethernet Header types defined by the IEEE and in use today. So, one question comes to mind: When a Ethernet receiver receives a frame, how does it know what kind of header it is? After all, if a receiver is unable to properly recognize the header type, it will not be able to properly extract the frame data and send it to the proper upper layer protocol or application.

Three possible Ethernet header types a receiver might see:

– Ethernet V2 (aka DIX) 802.3 Revised by IEEE in 1997
– Original IEEE 802.3 Ethernet
– Original IEEE 802.3 with a SNAP Header


(image credit: CCIE Routing & Switching Exam Guide Vol 3)

As you can see from the frame formatting above, there is no difference between frame types until the field immediately following the 2-byte Type/Length field. The first thing we will need to know is if the field immediately following Type/Length is a Data field (as would be the case with the IEEE modified Ethernet V2 frame), or is it a 802.2 DSAP field (as would be the case in an original IEEE 802.3 frame)? The answer to this question lies in the value of the Type/Length field.

If the Type/Length field has a value of 1536 or higher then the frame is Ethernet V2 and the Type/Length field represents the Type of data to immediately follow in the Data field. If the Type/Length field has a value of less than 1536 then it represents a Length and we can assume the field immediately following is a 802.2 DSAP. If we find that a DSAP field follows the Type/Length field, next we need to find out if this frame contains a SNAP header immediately following the 802.2 Control field. The presence of a SNAP header is signified by the DSAP field having a value of 0xAA hex. If DSAP has a value of 0xAA then we know a SNAP header immediately follows the 802.2 Control field.

In summary, for a receiver to discern the type of Ethernet header it’s receiving it needs to look at the value of the Type/Length field. If the Type/Length field signifies the presence of 802.2, then the receiver will know if a SNAP header is present by looking at the contents of the 802.2 DSAP field.



References:CCIE Routing & Switching Exam Guide Vol 3


  1. Thomas B. says

    This is probably obvious to everyone else, but I can’t seem to figure it out. If Type/Length indicates a Type, how do you determine the Length? Do you just look for an interframe gap or something?

    • owlman says

      Ethernet is a type of self-clocking synchronous serial communication. On the wire, the Ethernet signal has an embedded clock, so the hardware knows exactly when the first and last bits arrive (because no clock information means no data). It simply has to count the bits, then divide by 8 to get the byte count of the frame.

      I think 35 years ago when they invented Ethernet it was quite expensive hardware-wise to count the bits, so they included the length in the frame for easier processing…

    • naxidavid says

      In order to allow some packets using Ethernet v2 framing and some packets using the original version of 802.3 framing to be used on the same Ethernet segment, EtherType values must be greater than or equal to 1536 (0x0600). That value was chosen because the maximum length of the payload field of an Ethernet 802.3 frame is 1500 octets (0x05DC). Thus if the field’s value is greater than or equal to 1536, the frame must be an Ethernet v2 frame, with that field being a type field.[3] If it’s less than or equal to 1500, it must be an IEEE 802.3 frame, with that field being a length field. Values between 1500 and 1536, exclusive, are undefined.[4] This convention allows software to determine whether a frame is an Ethernet II frame or an IEEE 802.3 frame, allowing the coexistence of both standards on the same physical medium.


Leave a Reply

Your email address will not be published. Required fields are marked *