EtherType

EtherType is a two-octet field in an Ethernet frame. It is used to indicate which protocol is encapsulated in the payload of the frame and is used at the receiving end by the data link layer to determine how the payload is processed. The same field is also used to indicate the size of some Ethernet frames.

EtherType is also used as the basis of 802.1Q VLAN tagging, encapsulating packets from VLANs for transmission multiplexed with other VLAN traffic over an Ethernet trunk.

EtherType was first defined by the Ethernet II framing standard and later adapted for the IEEE 802.3 standard. EtherType values are assigned by the IEEE Registration Authority.

Header usualy is 14 bytes long (it can be extended to 16 if 802.1Q included), most important fields:

Dst MAC - 6 bytes
Src MAC - 6 bytes
802.1Q: - 2 bytes (3 bits CoS) + VLAN 12 bits
Next protocol: 2 byte

Usualy:
dmac(6)+smac(6)+etype(2)+payload(1500)+crc(4) = 1518 bytes
dmac(6)+smac(6)+8100(2)+vlan/Qos(2)+etype(2)+payload(1500)+crc(4) = 1522 bytes
/* Check fragmentation section

Ethernet II
  Destination: Broadcast (ff:ff:ff:ff:ff:ff) <<< Destination MAC goes firest for fast switchin
    Address: Broadcast (ff:ff:ff:ff:ff:ff)
    .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
    .... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
  Source: Cisco_e1:a0:68 (2c:54:2d:e1:a0:68) <<< Source follows DST MAC - we need to know who sent it
    Address: Cisco_e1:a0:68 (2c:54:2d:e1:a0:68)
    .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  Type: 802.1Q Virtual LAN (0x8100)
802.1Q Virtual LAN <<< In the ethernet we can include VLAN information
  000. .... .... .... = Priority: Best Effort (default) (0)
  ...0 .... .... .... = DEI: Ineligible
  .... 0000 1100 1000 = ID: 200
  Type: ARP (0x0806)  <<< Information about the payload (next header)