tcpdump: "ethertype Unknown"?

Solution 1:

It looks like there is an offset of 4 bytes in the dump. The ethertype is "0800" but tcpdump believes the ethertype is "0045" which is really the beginning of the IP header.

Maybe you are using a VLAN (which adds 4 bytes to the frame). Yes, it can be related to offloading, or to the interface (eg. use eth0.X instead of eth0 where X is the VLAN). And no, it does not sound harmful.