How to identify the protocol after ARP

Thanks grahamb. And you can identify ARP by the type field of ethernet, right?. And how can you identify an protocol after ARP? Or how can I know how many padding bytes there are after the ARP protocol?

The padding issue is more difficult. Wireshark has a display filter field eth.padding that contains the padding bytes, but nothing I know of to actually say the length of that padding.

You seem to be implying that you have Ethernet frames contain ARP traffic followed by something else. If so can you post an example capture illustrating this somewhere,. e.g. CloudShark, Dropbox, Google Drive, and post the link back by editing your question?

And you can identify ARP by the type field of ethernet, right?

RIght.

And how can you identify an protocol after ARP?

As Graham said, there isn't a protocol after ARP within a given Ethernet frame - there's the Ethernet header, there's the ARP packet, there's the padding, and that's it. The same applies for other link-layer protocols such as 802.11, except that the other protocols don't have a minimum frame length, so there's no padding.

Or how can I know how many padding bytes there are after the ARP protocol?

Yes, the only stuff after ARP would, on Ethernet, be padding. You find out how many padding bytes there are by:

• finding out how big the entire Ethernet packet is;
• subtracting 14 from that value for the Ethernet header (and, if the packet you have includes the FCS, subtract another 4 bytes for the FCS);
• parsing the ARP packet to figure out how big it is (add the size of the fixed-length portion of the ARP packet to the lengths of the addresses in the packet);
• subtracting the size of the ARP packet from the result of the previous subtraction.