Question: I think at **L2** it will be **ether type** and **destination MAC address**.
at **L3** it can be **protocol field** and **Destination IP Address**.

I want to know what are the other fields by which we can differentiate between control and data packet.

Answer: 
@Anupam Thakur: In pure L2 infrastructure, on receiving frame, node does the bridge-table/l2-table/cam lookup based on destination mac address. For different BPDUs (almost always reserved multicast mac dst addresses, few exceptions beyond the scope of this question) wherever required cam table is programmed with punt path to control-plane module (/also). Note, punt path doesn't distinguish between different protocols. It's job is to just push the packet in Q towards control-plane module. When cp module receives such packet, based on ethertype or LLC content it determines the further protocol processing of the packet.
"Router Alert Option" in IP header can also force packet to be punted to Control Plane, even though it is not destined for recipient device. (i.e. transit node)