This wiki has been migrated to and is now deprecated. Please use that site instead.

Ethernet (IEEE 802.3)

Ethernet is the most common local area networking technology, and, with gigabit and 10 gigabit Ethernet, is also being used for metropolitan-area and wide-area networking.

It is specified by [ various IEEE 802.3 specifications].

Ethernet sends network packets from the sending host to one or more receiving hosts. The hosts are addressed by their MAC addresses, a 6 byte number usually displayed as: 08:00:08:15:ca:fe (the delimiters vary, so you might see 08-00-08-15-ca-fe or alike).

A destination address of ff:ff:ff:ff:ff:ff indicates a ["Broadcast"], meaning the packet is send from one host to any other on that network.

XXX - also describe multicast.

Ethernet uses a 16bit type field to indicate which upper layer protocol should be used. Some examples:


XXX - add a brief description of Ethernet history

Protocol dependencies

Example traffic

XXX - Add example traffic here (as plain text or Ethereal screenshot).


The Ethernet dissector is fully functional.

Preference Settings

(XXX add links to preference settings affecting how Ethernet is dissected).

Example capture file

XXX - Add a simple example capture file. Keep it short, it's also a good idea to gzip it to make it even smaller, as Ethereal can open gzipped files automatically.

Display Filter

A complete list of Ethernet display filter fields can be found in the [ display filter reference]

Capture Filter