Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have four packets captured in wireshark. ARP request and reply packets and ICMP packets. What field and values are used to identify the different packets carried by an ethernet frame?

share|improve this question

The Ehternet frame has a type field (byte 0x0C, see Ethernet and EtherType):

0000   ff ff ff ff ff ff AB AB AB AB AB AB 08 06
  • 0x0806 = ARP
  • 0x0800 = IP Packet

The IP packet has additional headers to identify the protocol (see IPv4)

0000   ff ff ff ff ff ff AB AB AB AB AB AB 08 00 45 00
0010   00 3c 66 f0 00 00 80 01
  • 0x01 = ICMP
  • 0x06 = TCP
  • 0x11 = UDP
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.