MACsec uses an Ethertype of 88E5. This presents an obvious problem when encrypting frames which already have, or should have, another Ethertype. This RedHat blog, for example, states "[MACsec] can secure all traffic within a LAN, including DHCP and ARP, as well as traffic from higher layer protocols". How can ARP be secured when it has to have an Ethertype of 0806?

More generally, if you have an encypted backbone/switch/WLAN/whatever which talks to unencrypted endpoints, then the switch will encrypt plain Ethernet frames on ingress, and decrypt on egress. During this process, the original Ethertype is lost, since there's nowhere to store it in a MACsec frame, so what does the switch put in the outgoing Ethertype?

I guess one option is for the switch to only encrypt a specific Etherype - IPv4, say - and replace the incoming 0800 with 88E5, and reverse that at the output. This doesn't seem particularly useful though. Thanks.

  • "the original Ethertype is lost, since there's nowhere to store it in a MACsec frame" I'm not sure where you got that idea. MACsec actually adds to the frame. Remember that 802.1Q adds to the ethernet frame, moving the Ether Type field down, and inserting a different Ether Type field and other fields. MACsec adds eight octets to the ethernet frame header, and 16 octets at the end of the frame.
    – Ron Maupin
    Dec 3, 2018 at 19:20
  • Wow. Spent all day reading the docs and missed that. If you want to make that an answer I'll accept it.
    – EML
    Dec 3, 2018 at 19:26
  • OK. I did that.
    – Ron Maupin
    Dec 3, 2018 at 19:34

1 Answer 1


MACsec actually adds to the ethernet frame header and trailer. You end up with a different value in the Ether Type field position, much like you do with 802.1Q, but the original Ether Type field is preserved.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.