I'm sniffing ARP packets in Wireshark and wondering what exactly means filed protocol type.

The field is always 0x0800 for IPv4. Is it the same for IPv6?

Is there a possibility to change the value for this field? If no, I still want to know what are possible values for this field?

  • If you change that protocol type the protocol itself will be changed i.e. then that packet will not be considered as ARP packet.
    – Biswapriyo
    Apr 3 '18 at 17:39

You ought to be able to find all registered Ethertypes at either https://www.iana.org/assignments/ieee-802-numbers/ieee-802-numbers.xhtml or http://standards-oui.ieee.org/ethertype/eth.txt.

As you can see from those reference pages, Ethertype 0x800 is assigned to "Internet Protocol version 4 (IPv4)", and Ethertype 0x86DD is assigned to "Internet Protocol version 6 (IPv6)".

But those are only the registered Ethertypes. The field itself can have any value, although not all values would necessarily make sense. Also keep in mind that the field only specifies an Ethertype for Ethernet II framing whereas it's a length field for the original IEEE 802.3 framing format. Read more at https://en.wikipedia.org/wiki/Ethernet_frame (and other places).

I don't know what you mean by, Is there a possibility to change the value for this field?, but if you have captured packets to a file, you can of course modify the field with any suitable editor. The result of editing the field will likely not make any sense though.

  • Thank you for the links. By changing I mean if I can send somehow e.g. IPv6-packet and see in Wireshark that field Protocol Type has changed for this packet
    – ans
    Apr 3 '18 at 17:24
  • If you send an IPv6 packet, the Ethertype for that packet will indicate 0x86DD instead of 0x0800. Apr 3 '18 at 17:29
  • How can I do it? I tried to use ping -6 but it didn't seem to work
    – ans
    Apr 3 '18 at 17:36
  • The IP address should be ipv6.
    – Biswapriyo
    Apr 3 '18 at 19:28
  • @Ans-lte maybe if you have a virtual pc with an IPv6 address
    – barlop
    Apr 3 '18 at 21:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.