常见的二层协议包括IP、IEEE 802.1Q、IEEE 802.3等,协议分析过程中需要根据链路层第13、14字节内容确定二层协议类型。
IPv4(0x0800) 为例
已知的二层协议定义如下:
Ethertype (decimal) | Ethertype (hex) | Exp. Ethernet (decimal) | Exp. Ethernet (octal) | Description | Reference |
0000-1500 | 0000-05DC | - | - | IEEE802.3 Length Field | [IEEE Std 802.3] |
0257-0511 | 0101-01FF | - | - | Old Xerox Experimental values. Invalid as an Ethertype since 1983. | [Neil_Sembower] |
512 | 200 | 512 | 1000 | Formerly XEROX PUP. Invalid as an Ethertype since 1983. Use 0x0A00. | [Boggs, D., J. Shoch, E. Taft, and R. Metcalfe, "PUP: An Internetwork Architecture", XEROX Palo Alto Research Center, CSL-79-10, July 1979; also in IEEE Transactions on Communication, Volume COM-28, Number 4, April 1980.][Neil_Sembower] |
513 | 201 | - | - | Formerly PUP Addr Trans. Invalid as an Ethertype since 1983. Use 0x0A01. | [Neil_Sembower] |
1024 | 400 | - | - | Old Nixdorf private protocol. Invalid as an Ethertype since 1983. | [Neil_Sembower] |
1536 | 600 | 1536 | 3000 | XEROX NS IDP | ["The Ethernet, A Local Area Network: Data Link Layer and Physical Layer Specification", AA-K759B-TK, Digital Equipment Corporation, Maynard, MA. Also as: "The Ethernet - A Local Area Network", Version 1.0, Digital Equipment Corporation, Intel Corporation, Xerox Corporation, September 1980. And: "The Ethernet, A Local Area Network: Data Link Layer and Physical Layer Specifications", Digital, Intel and Xerox, November 1982. And: XEROX, "The Ethernet, A Local Area Network: Data Link Layer and Physical Layer Specification", X3T51/80-50, Xerox Corporation, Stamford, CT., October 1980.][Neil_Sembower] |
1632 | 660 | - | - | DLOG | [Neil_Sembower] |
1633 | 661 | - | - | DLOG | [Neil_Sembower] |
2048 | 800 | 513 | 1001 | Internet Protocol version 4 (IPv4) | [RFC-ietf-intarea-rfc7042bis-11] |
2049 | 801 | - | - | X.75 Internet | [Neil_Sembower] |
2050 | 802 | - | - | NBS Internet | [Neil_Sembower] |
2051 | 803 | - | - | ECMA Internet | [Neil_Sembower] |
2052 | 804 | - | - | Chaosnet | [Neil_Sembower] |
2053 | 805 | - | - | X.25 Level 3 | [Neil_Sembower] |
2054 | 806 | - | - | Address Resolution Protocol (ARP) | [RFC-ietf-intarea-rfc7042bis-11] |
2055 | 807 | - | - | XNS Compatability | [Neil_Sembower] |
2056 | 808 | - | - | Frame Relay ARP | [RFC1701] |
2076 | 081C | - | - | Symbolics Private | [David_Plummer] |
2184-2186 | 0888-088A | - | - | Xyplex | [Neil_Sembower] |
2304 | 900 | - | - | Ungermann-Bass net debugr | [Neil_Sembower] |
2560 | 0A00 | - | - | Xerox IEEE802.3 PUP | [Neil_Sembower] |
2561 | 0A01 | - | - | PUP Addr Trans | [Neil_Sembower] |
2989 | 0BAD | - | - | Banyan VINES | [Neil_Sembower] |
2990 | 0BAE | - | - | VINES Loopback | [RFC1701] |
2991 | 0BAF | - | - | VINES Echo | [RFC1701] |
4096 | 1000 | - | - | Berkeley Trailer nego | [Neil_Sembower] |
4097-4111 | 1001-100F | - | - | Berkeley Trailer encap/IP | [Neil_Sembower] |
5632 | 1600 | - | - | Valid Systems | [Neil_Sembower] |
8947 | 22F3 | - | - | TRILL | [RFC6325] |
8948 | 22F4 | - | - | L2-IS-IS | [RFC6325] |
16962 | 4242 | - | - | PCS Basic Block Protocol | [Neil_Sembower] |
21000 | 5208 | - | - | BBN Simnet | [Neil_Sembower] |
24576 | 6000 | - | - | DEC Unassigned (Exp.) | [Neil_Sembower] |
24577 | 6001 | - | - | DEC MOP Dump/Load | [Neil_Sembower] |
24578 | 6002 | - | - | DEC MOP Remote Console | [Neil_Sembower] |
24579 | 6003 | - | - | DEC DECNET Phase IV Route | [Neil_Sembower] |
24580 | 6004 | - | - | DEC LAT | [Neil_Sembower] |
24581 | 6005 | - | - | DEC Diagnostic Protocol | [Neil_Sembower] |
24582 | 6006 | - | - | DEC Customer Protocol | [Neil_Sembower] |
24583 | 6007 | - | - | DEC LAVC, SCA | [Neil_Sembower] |
24584-24585 | 6008-6009 | - | - | DEC Unassigned | [Neil_Sembower] |
24592-24596 | 6010-6014 | - |