EtherType

EtherType is a two-octet field in an Ethernet frame. It is used to indicate which is encapsulated in the payload of the frame. The same field is also used to indicate the size of some Ethernet frames. EtherType was first defined by the Ethernet II framing standard, and later adapted for the IEEE 802.3 standard.

In modern implementations of Ethernet, the field within the Ethernet frame used to describe the EtherType also can be used to represent the size of the payload of the Ethernet Frame. Historically, depending on the type of Ethernet framing that was in use on an Ethernet segment, both interpretations were simultaneously valid, leading to potential ambiguity. Ethernet II framing considered these octets to represent EtherType while the original IEEE 802.3 framing considered these octets to represent the size of the payload in bytes.

In order to allow Ethernet II and IEEE 802.3 framing to be used on the same Ethernet segment, a unifying standard, IEEE 802.3x-1997, was introduced that required that EtherType values be greater than or equal to 1536. That value was chosen because the maximum length (MTU) of the data field of an Ethernet 802.3 frame is 1500 bytes. Thus, values of 1500 and below for this field indicate that the field is used as the size of the payload of the Ethernet frame while values of 1536 and above indicate that the field is used to represent EtherType. The interpretation of values 1501–1535, inclusive, is undefined.

With 802.1Q VLAN tagging and QinQ the sparse 16-bit EtherType is being completely used. The 16-bit EtherType not only tags the payload class, it also serves to help end any VLAN tagging or QinQ stacking. Via look-ahead peeking in streams, the 16-bit EtherType can help to confirm or package a QinQ 32+32+16=80-bit header between the 48-bit MAC addresses and the payload. Of those 80-bits only 32-bits are used for dynamic information. For a full 66-bit addressing system, 18 bits are needed beyond the MAC. Thus, additional EtherType values are required and used for Triple Tagging QinQinQ.

Inefficient and conservative use of a 16-bit Tag Protocol Identifier (TPID) on each four octets VLAN tag, followed by the trailing lone 16-bits creates a 48-bit signature that cannot easily be mistaken as part of the payload. Vendor implementations may avoid wasting bandwidth sending those 48-bits in proprietary link compression schemes. The EtherType usually does not contain any CRC or FCS information.

...
Wikipedia