IPv4 Packet Header

The IP Version 4 Packet

We took a look at the addressing, and we took a look at layer 3 and what layer 3 looks like. Now we come to the packet itself.

An IP version 4 header has some sort of payload, or possibly not, and then it has the IP header. The IP header is about 20 bytes. There are some options that can be included into this, which would extend how big the IP header is, but that's not altogether common, so we don't need to worry too much about those options.

The payload is typically between 0 and 1,480 bytes, although we can actually have packets that are much larger than that, and we'll see the reason why for that. There's some sort of maximum transmission unit that this is capable of handling, that most equipment is capable of handling, so we typically see a max payload of 1,480 to make the whole thing typically around 1,500 bytes. That's what a packet size is.

One thing to terms frame and packet: a frame is generally associated more with layer two, as it's formed in layer two, and a packet is the layer three. The packet is going to remain mostly consistent throughout this process of transmitting this data.

Reading the Header Diagram

Ideally, I'd have the IP version 4 header spread across — I used to do it across the whiteboard and have it spread across this whole whiteboard — because the way a computer will read this and send this data is in a stream of bits. You'll have ones and zeros all in a stream, and it'll all be, in my mind, kind of horizontal as it's sending it across. But we don't have space to do that here, so I'm going to go vertical with this.

What you'll see here is typically what's found in textbooks, or if you're looking online, this is what you're going to see. Across the top I've got these in blocks of octets, so you'll see four octets across the top, or bytes. That's one byte. I've actually got it marked down into bits right here, so you'll see the bit level right there and how these different components are broken down into the bits. On the top row we have what's representing byte 0 through 3, the next one is byte 4 through 7, and the next one is byte 8 through 11. We've just stacked this all on top of each other so we can see the whole thing as a whole.

Version

First up, we have the version. The version, if you notice, is taking up four bits. So there's four bits here. It has up to 16 possibilities, or 0 through 15, to represent it. The version is just what version of header this is, and so we're looking at an IP version 4 header. That way, when this comes into the equipment, into the router, the router is going to see that this is going to be an IP version 4 header. Or if it was IP version 6, it would say IP version 6 in here. And so then it knows how to handle this packet. If it is an IP version 4, then we would actually see specifically the bits 01 0.

Internet Header Length

Next up is the IHL, or the internet header length. We see that there is four bits, so this could represent a number anywhere from 0 through 15. What it represents is how big the header is. It's going to represent what we're looking at right here — not the payload, but just the internet header. The internet header is going to include all of what we're seeing right here, but typically we don't have an option on here, so typically it would just represent this right here.

It's represented in how many 32-bit parts of this internet header there is. Since there's 32 across here, to figure out the number that's supposed to go in this IHL, all we have to do is count how many lines there are. So we count the lines: 1, 2, 3, 4, 5. That five is going to be what's represented in there, or it would be a 0 1 0 1 that we'd see here in the internet header length. Since options aren't typically included in our packets, then typically what we'd see in an IP version 4 header is going to be a 0 1 0 1. If there is more than that, if there exists more lines that it's including, then that means we have some sort of options available, and so this will specify: hey, you've got to look at those options.

DSCP

Next, we have the DSCP, or the differentiated service code point. The DSCP is just a fancy title to say what type of packet this is, what information is it hauling across this line. This might be to flag or signal things like voice over IP so that it can prioritize this packet. In fact, this field used to be called the type of service, or ToS. It specifies, once again, just what the payload is, so that the router, or whatever equipment it's going across, will know how to handle this packet.

ECN

Next is the ECN, or what is known as the explicit congestion notification. The ECN is just a way to send information from one point to another saying, "Hey, there's some congestion that's happening." Then the devices on each side can start shaping the traffic a little differently and start making some changes, because there is some congestion. This is just a way that some of the devices can communicate when there's congestion on the line.

Total Length

Then we have the total length. We can see it's two octets, or two bytes, big, so that would be 16 bits. So if we take 10 to the 16th power, different possibilities. Essentially, what this is is this tells you what the total length of the packet is — header and payload. Header and payload, the total length can be 65,536.

Typically what we find is most equipment can't handle that large of a packet, so we have a maximum transmission unit that is much smaller than that. But IP version 4 packets are capable of handling bigger packets if the equipment is equipped to handle those bigger packets. Once again, what this is is it's telling what is the total size of this packet.

Identification

Then we have identification. This identification field is 16 bits long, and it can identify the packet. It's primarily used if a packet needs to be fragmented and then reassembled on the other side. It's primarily used to identify which packets belong with each other, so that way they can be reassembled on the other side.

Flags and Fragment Offset

Next up we have flags. The flags are little bits that we can turn to ones and zeros to flag whether something exists or something doesn't exist. In this particular case, these flags are associated with the identification and the fragment. Really, it has to deal with fragmenting, and so we can identify certain components of the fragment just by turning these bits on or off.

Then we have the fragment offset, and we can see by this that it is 8, 9, 10, 11, 12, 13 — we've got 13 bits that represent this. What this just is is that if something is fragmented, if one of these packets is fragmented, then this is how much offset from the first packet. Or in other words, it tells the machine on the other end how to reassemble fragmented packets.

Time to Live

Next up is the time to live, or the TTL. A time to live on a packet is to prevent, if there is a routing loop, to prevent this from continuing on forever. What I mean by that is there are times when a packet is getting passed from piece of equipment to piece of equipment back to a piece of equipment. It's formed some sort of loop, or maybe even it's going between two pieces of equipment where it's being sent out and being sent right back. That can happen because each one of your routers could think that the network that it's trying to send this information off to exists on the other side, and so it keeps sending this back and forth.

The problem with that is you get enough of that traffic and it can your network. It can bring it down to its knees. So to eliminate any kind of packets that get stuck in this loop, there's this time to live. What will happen is every time it passes through a layer three piece of equipment, that time to live will get decremented by one. Eventually that time to live will come down to zero, and then that piece of equipment that is processing it will get rid of it, and that will no longer continue to exasperate the problem by creating that loop and having that packet live in that loop.

Protocol

Next up, we have the protocol. The protocol is defined with eight bits, or a byte. That protocol just defines what's within the payload and what information is being transferred over.

Header Checksum

Next up, we have the header checksum. The header checksum is 16 bits long. What it will do is, when a machine will assemble this packet, it will do a little algorithm to the header and create a hash out of it. Then, when it's sent across to another device, that device will take a look at that header and it will go through the same algorithm and create a hash, and it'll compare those hashes. If the hashes are different, something was not calculated correctly, and so it will drop that packet, because there's something wrong with the packet. The header checksum is a checksum that allows us to make sure that the information being sent across isn't getting corrupted along the way.

What's interesting about this is that we do change the header with this time to live. Every time it hits a new device, a new layer 3 device, it has to recalculate that time to live by decrementing it by one, and so it has to recalculate the header checksum. So every stop along this layer three, from network to network as it goes along, it's going to actually recalculate this header checksum along its path.

Source and Destination IP Addresses

Then, of course, what we do have is the source IP. The source IP, as we know, is four octets long, or it is four bytes. It is 32 bits long. And so we have the source IP address right here. Then we also have the destination IP address. The destination IP address is the same: it's four bytes long, 32 bits.

That layer 3 device, that layer 3 router, is going to take that destination IP address and figure out where it needs to send it next. How do I send this on to its next location?

Options

Lastly, we have the options field. The options right here, this was to incorporate some options into IP version 4 to allow some additional functionality. We don't see this commonly used. In fact, there's a lot of devices that will — it's been used for some nefarious purposes, so a lot of devices will actually, for security purposes, get rid of packets that have options that are incorporated into it. So we don't really see the options as being used all that much, which is, once again, why our IHL, which specifies our internet header length, will usually remain at five, or that there's five lines that are part of this.