IP/Network

Header : IPv4

Following is the structure of IPv4 header. The default size is 20 bytes and it can be as large as 60 bytes depending on the size of Options field.

Version

This field (4 bits) indicates IP version. It is always 4 in IPv4 header.

Internet Header Length (IHL)

This field (4 bit) indicates the length of the IP header and the unit is 4 bytes (32 bits). So, if the value of this field is 5, it means the length of IP header is 20 bytes (= 5 x 4 bytes).

Header Size in Bytes = IHL * 4

Since max value of IHL value is 15 (4 bits), the max size of IPv4 header is 60 bytes.

DSCP (Differentiated Services Code Point)

This field (6 bits) used to be called  ToS('Type of Service') and now renamed to DSCP. Refer to rfc2475 for the details.

ECN(Explicit Congestion Notification)

This field (2 bits) is used for end to end notification of Network Congestion. It has following meaning

• 00 – Non ECN-Capable Transport, Non-ECT
• 10 – ECN Capable Transport, ECT(0)
• 01 – ECN Capable Transport, ECT(1)
• 11 – Congestion Encountered, CE.

Total Length

This field (16 bits) indicates the total length of the IP packet (Length of IP header + Length of payload) in bytes. The minimum value is 20 bytes since the minimum IPv4 header length is 20 bytes.

The length of field is 16 bits. This means the max length of one IP packet is 2^16 Bytes (65535 bytes) including the header. the minimum length of one IP packet is 20 bytes which is the case in which there is only IP header and No payload.

Identification

This field (16 bits) is used to uniquely identify a group of fragments that belongs to the same IP diagram.

Flags

This field (3 bits) is used to control and indentify the fragments. The meaning of each bit is as follows.

• bit 0: Reserved; must be zero.
• bit 1: Don't Fragment (DF)
• bit 2: More Fragments (MF)

For unfragmented packets, the MF flag is set to be 0.

For fragmented packets, bit 0 set to be 0, bit 1 is set to be 0 and bit 2 is set to be 1 (However, in case of the last fragment of the fragmented packets all bits are set to be 0)

Fragment Offset

This field (13 bits) indicates the position of a fragemented packets from the biginning of the original packet. The unit is the multiples of 8 bytes. For example, if the value is 1, it menas the fragment offest is 8 bytes . if the value is 10, it means the fragment offset is 80 bytes. The value for unfragmented packet or the first fragment of the fragmented packet is set to be 0.

Time to Live

This field (8 bits) indicates how long the packet can survive in the network. Even though the unit is in seconds, it is practically interpreted as the number of hops it can go through. When the datagram arrives at a router, the router decrements the TTL field by one. When the TTL field hits zero, the router discards the packet and typically sends an ICMP Time Exceeded message to the sender. In this way, we can avoid the situation in which a packet goes round and round within the network without reaching the final destination.

Protocol

This field (8 bits) indicates the protocol of the payload part and can be specified by one of the following values.

Header Checksum

This field (16 bits) carries the checksum value of the header. It may be confusing.. because Header Checksum field is also a part of the header. So you may ask 'does checksum calculation includes HeadChecksum field or not ?'. The answer is 'Yes, the HeadChecksum field is also used in the checksum calculation, but the value is always assumed to be all zero.

Source Address / Destination Address

Both Source address and Destination Address takes 32 bits for each. These address are represted as follow format.

W.X.Y.Z

W, X, Y, Z can be any number between 0 and 255, but depending on various purpose/class these number can take a specific range of values as below. (You can figure out the IP set to your PC using ipconfig command (in windows) or ifconfig (in Linux) and you can figure out the ip for a specific site using nslookup).

Followings are IP addresses that are reserved for private networks.

Followings are some of the IP addresses that are reserved for special purpose.

Example 01 > ===========================================================

Internet Protocol Version 4, Src: 1.1.1.100 (1.1.1.100), Dst: 1.1.1.1 (1.1.1.1)

    Version: 4

    Header length: 20 bytes

    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))

        0000 00.. = Differentiated Services Codepoint: Default (0x00)

        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)

    Total Length: 32

    Identification: 0x0a76 (2678)

    Flags: 0x00

        0... .... = Reserved bit: Not set

        .0.. .... = Don't fragment: Not set

        ..0. .... = More fragments: Not set

    Fragment offset: 0

    Time to live: 128

    Protocol: Unknown (253)

    Header checksum: 0x2b05 [correct]

        [Good: True]

Following is the HEX string and Binary String for the IP header decoded above, try decode each field on your own and compare your decoding with the wireshark decode shown above. You can get the C language example of IPv4 decoding if you are interested.

HEX : 45 00 00 20 0a 76 00 00 80 fd 2b 05 01 01 01 64 01 01 01 01

BIN :

01000101 00000000 00000000 00100000

00001010 01110110 00000000 00000000

10000000 11111101 00101011 00000101

00000001 00000001 00000001 01100100

00000001 00000001 00000001 00000001