Ethernet II framing

Ethernet v2 framing, also known as DIX Ethernet (named after the major participants in the framing of the protocol: Digital Equipment Corporation, Intel, Xerox) defines the 2-octet field following the destination and source addresses as an EtherType that identifies an upper layer protocol.

For example, an EtherType value of 0x0800 signals that the packet contains an IPv4 datagram. Likewise, an EtherType of 0x0806 indicates an ARP frame, and 0x8100 indicates IEEE 802.1Q frame.

As this industry-developed standard went through a formal IEEE standardization process, the EtherType field was changed to a length field in the new 802.3 standard. (Original Ethernet packets define their length with the framing that surrounds it, rather than with an explicit length count.) Since the packet recipient still needs to know how to interpret the packet, the standard required an IEEE 802.2 header to follow the length and specify the packet type. Many years later, the 802.3x-1997 standard, and later versions of the 802.3 standard, formally approved of both types of framing. In practice, both formats are in wide use, with original Ethernet framing the most common in Ethernet local area networks, due to its simplicity and lower overhead.

In order to allow some packets using Ethernet v2 framing and some packets using the original version of 802.3 framing to be used on the same Ethernet segment, EtherType values must be greater than 0x0600. That value was chosen because Ethernet 802.3 frames aren't supposed to exceed 1522 bytes (0x0600 = 1536 bytes > 1522 bytes). Thus if the field's value is greater than 0x0600, the frame must be an Ethernet v2 frame, with that field being a type field. If it's less than or equal to 0x0600, it must be an IEEE 802.3 frame, with that field being a length field.