0x0806

0x0806 is the EtherType value used in Ethernet II frames to identify the payload as an Address Resolution Protocol (ARP) message. In IPv4 networks, ARP uses this code to resolve IP addresses to physical MAC addresses on the local network segment.

ARP operates within a local network and is not routable across routers. A host issues a broadcast ARP request asking for the MAC address associated with a given IPv4 address. The device that owns that address replies with an ARP reply that includes its MAC address, enabling subsequent communication. ARP information is stored in a cache on each device to speed future transmissions.

In Ethernet frames, the Ethertype field carries 0x0806. The ARP payload contains fields such as hardware type (Ethernet = 1), protocol type (IPv4 = 0x0800), hardware size (6), protocol size (4), operation (1 for request, 2 for reply), plus sender and target hardware and protocol addresses. This structure allows devices on the same local network to map IP addresses to corresponding MAC addresses necessary for direct layer-2 delivery.

0x0806 is defined in standards and registries for ARP (RFC 826). It is commonly encountered in network debugging and traffic analysis. ARP itself lacks authentication, which makes it vulnerable to spoofing or poisoning attacks that can corrupt ARP caches and enable man-in-the-middle or traffic redirection. Mitigation strategies include static ARP entries, dynamic ARP inspection in switches, and vigilant network monitoring. Related Ethernet types include 0x0800 for IPv4 payloads and 0x86DD for IPv6.