Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have four packets captured in wireshark. ARP request and reply packets and ICMP packets. What field and values are used to identify the different packets carried by an ethernet frame?

share|improve this question
add comment

1 Answer

The Ehternet frame has a type field (byte 0x0C, see Ethernet and EtherType):

0000   ff ff ff ff ff ff AB AB AB AB AB AB 08 06
                                           ^^^^^
  • 0x0806 = ARP
  • 0x0800 = IP Packet

The IP packet has additional headers to identify the protocol (see IPv4)

0000   ff ff ff ff ff ff AB AB AB AB AB AB 08 00 45 00
0010   00 3c 66 f0 00 00 80 01
                            ^^
  • 0x01 = ICMP
  • 0x06 = TCP
  • 0x11 = UDP
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.