IPv4
The 20-byte header that gets a packet across the whole internet.
The IPv4 header
A real header, checksum included. Notice how some fields are only 3 or 4 bits wide.
Whole frame
45 00 00 2C 1C 46 40 00 40 06 20 97 C0 A8 01 14 CB 00 71 32: a 44-byte packet from 192.168.1.20 to 203.0.113.50 carrying TCP, with at most 64 hops left to live and fragmentation forbidden.
| Field | Offset | Example value | Meaning |
|---|---|---|---|
| Version | Byte 0, bits 7–4 | 4 | Always 4 for IPv4. The first nibble lets a receiver tell IPv4 from IPv6 (6) at a glance. |
| IHL | Byte 0, bits 3–0 | 5 words = 20 bytes | Header length in 32-bit words. 5 × 4 = 20 bytes, the minimum (no options). The maximum is 15 × 4 = 60 bytes. |
| DSCP | Byte 1, bits 7–2 | 0 = best effort | Differentiated Services Code Point: a quality-of-service hint (voice, video, best effort). 0 = default best effort. |
| ECN | Byte 1, bits 1–0 | 0 = not used | Explicit Congestion Notification: lets routers mark packets instead of dropping them when queues fill. |
| Total length | Byte 2–3 | 0x002C = 44 | Header plus payload in bytes: 20 + 24 (a TCP SYN with an MSS option) = 44. Maximum 65,535. |
| Identification | Byte 4–5 | 0x1C46 = 7238 | A number the sender picks per packet. If the packet is fragmented, all fragments carry the same value so the receiver can reassemble them. |
| Flags | Byte 6, bits 7–5 | 010 = DF set | Control bits for fragmentation. |
| Fragment offset | Bytes 6–7 | 0 | Where this fragment's data starts in the original packet, in 8-byte units. 0 = first (or only) fragment. |
| TTL | Byte 8 | 64 hops | Time To Live: each router subtracts 1, and at 0 drops the packet and reports back. It stops packets circling forever and is what traceroute exploits. |
| Protocol | Byte 9 | 6 = TCP | What the payload is: 1 ICMP, 6 TCP, 17 UDP. |
| Header checksum | Byte 10–11 | 0x2097 (✓) | A 16-bit one's-complement sum over the header only (not the payload). Computed here for real: 0x2097. Every router that decrements TTL must recompute it. |
| Source address | Byte 12–15 | 192.168.1.20 | The sender's IPv4 address, four bytes, one per dotted number. |
| Destination address | Byte 16–19 | 203.0.113.50 | The final destination. Unlike a MAC, this stays the same across every router on the way. |
Overview
IP is the layer that makes the internet one network. Its header names the source and destination (32-bit addresses), says how long the packet is and what it carries, and has a hop limit so no packet lives forever. Routers read this header, look up the destination and forward the packet: they never look inside the payload.
IP is best effort: it may lose, duplicate, reorder or fragment packets. Reliability is TCP's job.
Key facts
- Address
- 32 bits (4.3 billion)
- Header
- 20 bytes (up to 60)
- Max packet
- 65,535 bytes
- Checksum
- Header only, 16-bit
- Byte order
- Big-endian (network order)
- Standard
- RFC 791
Where you meet it
- Everything on the internet today still rides on IPv4 (or its successor IPv6)
- ICMP (ping, traceroute) is carried directly in IP
- Tunnels and VPNs wrap IP packets inside other IP packets
Watch out for
- TTL counts hops, not time. A traceroute simply sends packets with TTL 1, 2, 3... and reads who reports the expiry.
- Addresses run out: NAT lets many private hosts (192.168.x.x) share one public address, at the cost of end-to-end connectivity.
- The checksum does not cover the payload; TCP and UDP carry their own.
Standards
- RFC 791: Internet Protocol
- RFC 1071: Computing the Internet Checksum