I'm studying for some networking concepts and have learned that a receiving host looks at an Ethernet frame's header to determine what protocol being used by the packet. It makes me wonder though, since a packet header includes this same info, why doesn't Ethernet protocol try to save space in the frame by just determining what network protocol is being used by looking at the packet header?

Thank you for the help!

  • 2
    Because the network stack can do a simple lookup for which process to send the payload, rather than a complicated parse of the payload to determine if the payload is ARP, IPv4, IPX, AppleTalk, IPv6, etc.
    – Ron Maupin
    Commented Apr 16, 2020 at 12:17
  • 5
    To determine the format of the packet header
    – slebetman
    Commented Apr 16, 2020 at 17:18
  • 8
    How do you know that the packet header includes that same info? Commented Apr 17, 2020 at 1:32

2 Answers 2


The receiver has to look at the Ethernet frame to decide its contents, which might be DECnet, Appletalk or many other things -- Internet Protocol is only one of many protocols running on top of Ethernet.

When Ethernet was being designed, it wasn't obvious at all what protocols might exist in the future, and the winner-take-all effect wasn't obviously so large. A key goal of Ethernet was ubiquity -- in order to be cheap it had to be everywhere, and so it was designed to be completely neutral about its contents.

It's also a fundamental idea in the separation of the layers: code for each layer does not look inside the contents, it has a label on the outside which says what it contains along with whatever is required for addressing. For example the Ethernet frame might say "contains IP". Inside its payload, the IP header has a label which says "contains UDP". The UDP header says "contains DNS" (inferred from port number). And the DNS program is responsible for deciding what to do with that. If you don't do it like this then you duplicate at least a little of the code of the upper layer in the lower. (Or, required some kind of mechanism for the lower layer to ask an upper layer "is this packet one of yours?".) And, worse than that, this then limits the lower layer to working with upper layers which the lower-layer implementer knew and cared about. I guarantee you the Ethernet designers didn't know about IPv6, and it's the separation of layers which permits the easy development of new protocols.

Those who were obsessed about a few bytes generally wrote their protocols raw on top of Ethernet, essentially using it in the way we might use UDP. Most of those surely regretted it and converted to TCP or UDP later when they needed a facility such as ports or reliable ordered two-way byte streams, or indeed, multi-hop transport.

  • 2
    Thank you for your answer! Very good explanation and the idea of EtherType clicked once reading your explanation. Commented Apr 17, 2020 at 7:43
  • The UDP header doesn't contain a field indicating what type of data the payload contains
    – nog642
    Commented May 5, 2023 at 16:29
  • @nog642 Whilest strictly speaking the port numbers in the UDP header don't indicate the content type, in practice they are used for exactly this purpose. In the most common case, client initiating to a server, it contacts it on a well-known socket number such as 53 for DNS, with the contents intended to be interpreted as DNS communication. I've edited the answer slightly to reflect this.
    – jonathanjo
    Commented May 6, 2023 at 9:55

This is a fun question with a lot of history. Originally, the EtherType field indicated the length of the frame; not the type of payload. The relevant Wikipedia article contains a good explanation with references.

MPLS is an example of a protocol which lacks a field indicating the payload type. This has important consequences! Although the devices at each end of an MPLS LSP should know the type of payload -- because of how MPLS LSPs are signaled, transit devices or P-nodes do not know.

MPLS P-nodes have to guess about the payload type for some operations, such as equal-cost multi-path routing. This can have consequences when that guess is wrong. For example, MPLS routers generally misinterpret Ethernet pseudo-wire traffic destined for a MAC address beginning with a 6 as an IPv6 packet, not an Ethernet frame. This can cause unexpected packet re-ordering within flows, which can manifest as real problems for applications that don't tolerate re-ordering well!

This problem is so important that router manufacturers have designed several different approaches MPLS networks can use to allow MPLS ECMP hashing without explicitly signaling the payload type, such as Flow-Aware Transport and Entropy Labels.

  • 1
    Just a quick note: since the frame length field is totally redundant in how an Ethernet frame is built and transmitted, that field was repurposed as EtherType = next layer protocol (for values of 0x0600 and higher) which made a lot more sense. This step might have been one of the keystone decisions for Ethernet's success because it became compatible with anything riding on top!
    – Zac67
    Commented Apr 17, 2020 at 13:54
  • 2
    If you're going to mention MPLS, then maybe you could mention that the goal of MPLS is not to deliver packets to arbitrary addresses, but to establish virtual circuits in which all of the traffic in any given "circuit" follows the same route between the same two end points. Virtual-circuit networking equipment, in principle, doesn't need to know anything about an individual packet other than the identity of the circuit to which it belongs. The two endpoints are presumed to know why the circuit was established, and how to interpret the packets. Commented Apr 17, 2020 at 15:28
  • "Originally, the EtherType field indicated the length of the frame; not the type of payload." Hmm, my understanding was that the type field was the original and that using it as a length field was an invention of the later IEEE standardisation process. Commented May 7, 2023 at 2:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.