EtherType Lookup

Enter an EtherType in hex (0x0800 or 0800) to find its protocol name.

How it is calculated

The tool reads your entry as a hexadecimal number and looks it up in a built-in table of 25 well-known EtherTypes (IPv4, ARP, IPv6, 802.1Q VLAN, LLDP, MPLS, PPPoE and others). Hex is the only base: an optional 0x prefix is stripped, spaces are ignored, and digit-only entries are hex too, so 8100 and 0x8100 are the same value (33024 in decimal). The value must fit in 16 bits, up to FFFF; longer values, decimals typed as 34525, colon-separated pairs like 08:00 and non-hex letters give no result. The result shows the protocol name, the value as 4-digit hex and the decimal value. Values up to 0x05DC (1500) are labelled as an IEEE 802.3 length field, 0x05DD to 0x05FF as undefined, and values not in the table as unknown or unassigned.

Worked example

You spot 0x86DD in a packet capture. The tool drops the 0x prefix and reads 86DD as hex: 8 × 4096 + 6 × 256 + 13 × 16 + 13 = 34525. That value is in the table as IPv6, and the tool prints the hex form 0x86DD and the decimal form 34525. So the payload after the Ethernet header is an IPv6 packet. Typing 86DD without the prefix gives exactly the same answer, but typing 34525 does not work, since it is not read as decimal.

Try this example →

Common mistakes

  • Typing the decimal value (34525 for IPv6) because the number looks decimal: the tool treats every entry as hex, and 34525 is too large for 16 bits, so there is no result.
  • Assuming a digit-only entry such as 800 is decimal: it is read as hex 0x0800 and shows IPv4, not a length field.
  • Reading an Unknown / unassigned result as an invalid value. The table is short, so many registered EtherTypes are not named and need the IEEE registry.
  • Pasting a byte pair with a colon, such as 08:00; type 0800 or 0x0800 (a space between bytes is fine).
  • Expecting a value from 1501 to 1535 to be a length: only up to 1500 is a length field, and 0x05DD to 0x05FF is shown as undefined.

About this calculator

Every Ethernet II frame carries a 16-bit EtherType field right after the source MAC address, telling the receiving network stack which protocol's payload follows — 0x0800 for IPv4, 0x0806 for ARP, 0x86DD for IPv6, 0x8100 for an 802.1Q VLAN tag, and hundreds more registered with the IEEE. Values up to 1500 (0x05DC) mean a frame length instead under the older 802.3 standard (1501–1535 are undefined, and EtherTypes start at 1536, 0x0600), which is how a NIC or switch distinguishes an Ethernet II frame from an 802.3 frame at a glance.

This calculator takes an EtherType value in hexadecimal (with or without 0x; digits-only input such as 0800 is read as hex too) and returns the protocol name it identifies, plus the value in hex and decimal. It knows 25 common EtherTypes; a value up to 1500 (0x05DC) is reported as an 802.3 length field, 0x05DD–0x05FF as undefined, and anything else as unknown or unassigned. Network engineers reading packet captures, firmware developers writing frame parsers, and students studying the OSI data-link layer use it to quickly decode a common EtherType spotted in Wireshark or tcpdump output; for a rarer one, check the IEEE registry.

Was this helpful?

You can pick up to 3 reactions.

Comments

  • Be the first to comment.

Popular calculators

All Calculators