During class a question on jumbo Ethernet frames (usually 9000 bytes) was asked. A jumbo frame uses EtherType 0x8870, as shown in this excerpt from tcpdump/ethertype.h: #ifndef ETHERTYPE_JUMBO #define ETHERtype_Jumbo:.#defineETHERTYPEJumbob. : “Auto” is the default DTP mode on Cisco switches, not “auto” The NSA’s Cisco IOS Switch Security Configuration Guide is also helpful.”]
Source: https://taosecurity.blogspot.com/2006/08/more-notes-for-tcpip-weapons-school.html