From 0af77934100df64c8d050cc162cd133344c19838 Mon Sep 17 00:00:00 2001
From: Jeff Lucovsky <jlucovsky@oisf.net>
Date: Fri, 3 Oct 2025 10:18:03 -0400
Subject: [PATCH] output: Display ethertype properly

Ethertype values are now converted from network format to host format
before display occurs. Displayed values are now in hex instead of
integers.

Without this change, ethertype values such as 0xfbb7 are
displayed in decimal as: 47099 (0xb7fb).

The actual value is 64439 (0xfbb7); all logged ether_type values
will be displayed in host order in decimal format. This example
will log the ether type as 64439

Issue: 7855
---
 src/output-json.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/output-json.c b/src/output-json.c
index 1e04e13c49..a2ebf1e77a 100644
--- a/src/output-json.c
+++ b/src/output-json.c
@@ -761,7 +761,7 @@ static int CreateJSONEther(
         if (PacketIsEthernet(p)) {
             const EthernetHdr *ethh = PacketGetEthernet(p);
             SCJbOpenObject(js, "ether");
-            SCJbSetUint(js, "ether_type", ethh->eth_type);
+            SCJbSetUint(js, "ether_type", SCNtohs(ethh->eth_type));
             const uint8_t *src;
             const uint8_t *dst;
             switch (dir) {