Ethernet is the foundation of modern Internet Protocol (IP)-based networking. While Ethernet is well understood and defined, what is perhaps significantly less known is that there are different types of Ethernet protocols known as EtherTypes.

At the DEF CON security conference over the weekend, Ricky "HeadlessZeke" Lawshae, whose day job is principal researcher at Keysight, outlined the weird, wacky, and potentially dangerous world of EtherTypes.

EtherTypes are identified as a field inside an Ethernet data frame and define the type of protocol that is encapsulated in the packet. While Ethernet is commonly used for IPv4-based packets, also known by the EtherType hexadecimal value of 0x0800, there are actually more than 3,500 officially registered EtherTypes, according to the IEEE.

The fact that there are so many EtherTypes with broad capabilities could well represent all manner of risks for enterprise networks.

For example, one of the first largely unknown EtherTypes detailed by Lawshae is 0x814C for SNMP over Ethernet Protocol. Simple Network Management Protocol (SNMP) is widely used for network monitoring and management.

Lawshae said that with SNMP over Ethernet Protocol, a potential abuse could be getting control of network resources, with the added benefit of bypassing some firewall restrictions.

But wait, more EtherTypes are a potential risk to IT

As it turns out, there are a lot of EtherTypes dedicated to different types of network management for specific devices.

The 0x8899 RealTek Remote Control Protocol is another potential risk as it enables remote management of switches that are normally unmanaged. Lawshae noted that the RealTek protocol is supported in a relatively small number of chipsets and helps to provide information on network traffic.

One of the ways that Lawshae said that 0x8899 EtherType can potentially be abused is that a user could change their VLAN (Virtual LAN) tags, which is normally something that a regular user should never be allowed to do.

"So if you don't like the VLAN you're on because you feel lonely, you can change your VLAN tag to somebody else's VLAN, or you can actually set yourself up as the trunk or just get all of the traffic going through you," Lawshae said.

Remember DEC? Yup, there's an EtherType for that too

Digital Equipment Corporation, commonly just referred to as DEC, is a name from the past, a computer vendor that disappeared at the end of the 90s after being acquired by Compaq, which in turn was later acquired by Hewlett Packard.

While DEC is long gone, its network protocol, known as DECnet, apparently is not.

"Does anybody in the room remember DECnet?" Lawshae asked the boisterous DEF CON audience. "You should probably schedule a colonoscopy."

Part of DECnet is the Maintenance Operation Protocol (MOP), which has two EtherTypes: 0x6001 and 0x6002. Lawshae said the MOP protocol has functions to dump and load system memory, as well as provide a remote console into systems. Whenever a system was not functioning to the point where the users couldn't actually create a session on it, the MOP protocol could still potentially enable system recovery.

"So yeah, DECnet is gone, except that it's not because Cisco includes the MOP protocol on all of its routers enabled by default to this very day," Lawshae said.

Lawshae noted that he has found Cisco documentation that suggests organizations disable the MOP protocol, though it's unclear if that advice is always executed.

"The dumping memory, combined with the remote console, could be pretty killer," Lawshae said.

Power, trains, traffic lights & more all rely on EtherTypes

During his DEF CON session, Lawshae also outlined industrial EtherTypes, including GOOSE (Generic Object-Oriented Substation Events) 0x88b8, which is used for power system communication. He warned it's an EtherType that is still largely used with little or no authentication.

WAVE (Wireless Access in Vehicular Environments) 0x88dc is used for autonomous vehicles and also for helping to trigger emergency vehicle right-of-way with traffic lights, and it could potentially be abused. The Train Communication Network Protocol 0x894c is used to help identify the length of train cars, orientation, and door controls. Lawshae warned that potential abuse could be to open doors while a train is still in motion.

"At the end of this talk, you've seen how many crazy things there are out there on layer two networks," Lawshae said. "They're local only, but still so much fun to be had, especially when you're in weird environments."