Calculation accounting for Layer 2 overhead when viewing traffic statistics

You seem to have the general idea.

First, there really is no Physical Layer header. The Physical Layer simply takes what the Data-Link Layer gives it, and it encodes the Data-Link frame (encoding) for the interface and places that on the "wire" (signalling), or it performs the opposite when receiving data.

When layer-3 sends a packet to layer-2, layer-2 needs to encapsulate that with a layer-2 header. Part of the layer-2 header may include a MAC address for layer-2 protocols that use MAC addresses (not all do, and of those that do, some use 48-bit MAC addresses, and some use 64-bit MAC addresses).

In order to put a destination MAC address in the layer-2 frame, the destination layer-3 address must be resolved to a layer-2 address. Layer-2 needs the destination layer-2 MAC address in order to build the layer-2 frame to encapsulate the layer-3 packet. That is where ARP (Address Resolution Protocol) comes in.

ARP has to do with data leaving the host, not coming into the host where the headers are stripped. Depending on the network stack implementation, as a layer-2 frame come into a host, the MAC address may get saved in the host's ARP cache as the frame is stripped from the packet. Layer-2 will inspect the layer-2 frame to determine to which layer-3 protocol in the network stack the frame payload (layer-3 packet) should be sent.

The Ethertype field is a field in ethernet frame headers. Other layer-2 protocols have other ways of doing this. Remember, ethernet may be the most used layer-2 protocol, but it is not the only layer-2 protocol, and each have their own frame headers. Layer-3 protocols can have the the same type of thing. For instance, IPv4 has the Protocol field, and IPv6 has the Next Header field, to tell layer-3 to which layer-4 protocol the payload of the layer-3 packet should be sent.

That is correct - the IP layer is not required for communication within a LAN. On Ethernet for example, there's no reason a computer can't send an Ethernet frame addressed to some other computer with some non-IP data inside it.

However, now that the Internet is ubiquitous, TCP/IP is the most useful configuration and therefore the most work has gone into supporting it. There's rarely any reason for a commercial software vendor to make a protocol that runs directly over Ethernet, when they could make it run over IP instead, and have it be able to work on the Internet. I can't think of any protocols used by the average consumer that don't use IP, besides ARP. (NetBIOS used to be ubiquitous on Windows LANs).

However, professional networking gear does use such protocols. Two examples that came to mind are the IS-IS routing protocol, or STP used by Ethernet switches.

IS-IS could've run over IP, really (there's a similar protocol OSPF that does just that). STP runs on Ethernet switches, which might not even have IP addresses, so it really does need to run over Ethernet.

I imagine most protocols that run on IP (such as TCP) could be adapted to run over Ethernet, Token Ring, ATM, or whatever - but there would be no benefit to doing so.