I have a project where there is a custom implemented layer 2 protocol. An engineer before me decided to use what I'm used to as the Ethertype field as a size field. For awhile this looked right because he forgot to convert to network byteorder so the size was most times interpreted as an undocumented Ethertype and packet sniffers left it alone. I went to fix it and Wireshark started interpreting our packets as LLC frames which of course involves misconstruing the data in the payload as LLC fields. Is this a failure of Wireshark or do we run the risk of other devices making this same mistake? Is there any middle ground or does using Ethertype as size always imply an LLC/SNAP packet?

Sorry if this is the wrong place, I really wasn't sure where this belonged.

  • 1
    Why would you expect Wireshark to properly interpret a custom protocol?
    – Ron Maupin
    May 17, 2018 at 15:10
  • Oh it wont, I don't expect it to. But if wireshark makes the mistake of seeing it as an LLC frame it doesn't seem like a distant jump that others will as well. Or maybe Wireshark is being overreaching in it's classification and we're allowed to use the ethertype field that way and not necessarily be interpreted as LLC by other devices.
    – foreverska
    May 17, 2018 at 15:12
  • It depends on how the "device" interprets that field, which may be different than Wireshark. If the values fall in the valid range of size, it will be interpreted as LLC.
    – Ron Trunk
    May 17, 2018 at 15:45
  • In order: No. Yes. No. Ethernet is not "open to interpretation". That said, most layer-2 hardware won't care what's beyond DA and SA. (as long as your "size" isn't 0x8100, etc.)
    – Ricky
    May 17, 2018 at 19:32

1 Answer 1


Is there any middle ground or does using Ethertype as size always imply an LLC/SNAP packet?

If the value of that field is <= 1536, most implementations should interpret that as an 802.2 LLC frame. If it's outside that range, you're probably in uncharted territory as how the device might interpret it..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.