Packet structure

+---------------------------+
|         Packet type       |
|         (2 Octets)        |
+---------------------------+
|        ARPHRD_ type       |
|         (2 Octets)        |
+---------------------------+
| Link-layer address length |
|         (2 Octets)        |
+---------------------------+
|    Link-layer address     |
|         (8 Octets)        |
+---------------------------+
|        Protocol type      |
|         (2 Octets)        |
+---------------------------+
|           Payload         |
.                           .
.                           .
.                           .

Description

The packet type field is in network byte order (big-endian); it contains a value that is one of:

• 0, if the packet was specifically sent to us by somebody else;
• 1, if the packet was broadcast by somebody else;
• 2, if the packet was multicast, but not broadcast, by somebody else;
• 3, if the packet was sent to somebody else by somebody else;
• 4, if the packet was sent by us.

The ARPHRD_ type field is in network byte order; it contains a Linux ARPHRD_ value for the link-layer device type.

The link-layer address length field is in network byte order; it contains the length of the link-layer address of the sender of the packet. That length could be zero.

The link-layer address field contains the link-layer address of the sender of the packet; the number of bytes of that field that are meaningful is specified by the link-layer address length field. If there are more than 8 bytes, only the first 8 bytes are present, and if there are fewer than 8 bytes, there are padding bytes after the address to pad the field to 8 bytes.

The protocol type field is in network byte order; it contains an Ethernet protocol type, or one of:

• 1, if the frame is a Novell 802.3 frame without an 802.2 LLC header;
• 4, if the frame begins with an 802.2 LLC header.