How would I do this in wireshark?

Question

I have four packets captured in wireshark. ARP request and reply packets and ICMP packets. What field and values are used to identify the different packets carried by an ethernet frame?

Answer 1

The Ehternet frame has a type field (byte 0x0C, see Ethernet and EtherType):

0000   ff ff ff ff ff ff AB AB AB AB AB AB 08 06
                                           ^^^^^

• 0x0806 = ARP
• 0x0800 = IP Packet

The IP packet has additional headers to identify the protocol (see IPv4)

0000   ff ff ff ff ff ff AB AB AB AB AB AB 08 00 45 00
0010   00 3c 66 f0 00 00 80 01
                            ^^

• 0x01 = ICMP
• 0x06 = TCP
• 0x11 = UDP