Skip to content
W3S101

IPv4 Packet Structure

IPv4 - Packet Structure

Section titled “IPv4 - Packet Structure”

The Internet Protocol (IP) operates at Layer 3 (Network Layer) of the OSI model. It takes data segments from Layer 4 (Transport Layer, e.g., TCP or UDP) and encapsulates them into IP packets. Each IP packet consists of a header and a payload (the Layer 4 data).

The IP header contains crucial information for routing and delivering the packet across networks. Understanding the IPv4 header structure is key to understanding how IP works.

A typical IPv4 header is 20 bytes long, unless options are present. Here’s a breakdown of its fields:

  • Version (4 bits): Specifies the IP version. For IPv4, this field is always 4 (binary 0100).
  • IHL (Internet Header Length) (4 bits): The length of the IP header in 32-bit words. The minimum value is 5 (for a 20-byte header, 5 x 4 bytes = 20 bytes). If options are present, this value will be greater than 5.
  • DSCP (Differentiated Services Code Point) (6 bits): Part of the original Type of Service (ToS) field, now used for Differentiated Services (DiffServ) to enable Quality of Service (QoS) by classifying packets.
  • ECN (Explicit Congestion Notification) (2 bits): Also part of the original ToS field, ECN allows routers to signal network congestion to end-points without dropping packets.
  • Total Length (16 bits): The total length of the IP packet (header + payload) in bytes. The maximum size is 65,535 bytes, though packets are often much smaller due to network MTU (Maximum Transmission Unit) limitations.
  • Identification (16 bits): If an IP packet is fragmented (broken into smaller pieces to traverse networks with smaller MTUs), all fragments of the original packet share the same Identification value. This allows the destination host to reassemble them.
  • Flags (3 bits): Used for fragmentation control:
  • Fragment Offset (13 bits): When a packet is fragmented, this field specifies the offset of this fragment’s data relative to the start of the original IP packet’s data portion. It is measured in 8-byte units.
  • Time to Live (TTL) (8 bits): A counter that limits the packet’s lifetime. It’s set by the sender and decremented by one by every router that forwards the packet. If TTL reaches zero before the packet reaches its destination, the packet is discarded, preventing it from looping indefinitely in the network. An ICMP Time Exceeded message is usually sent back to the source.
  • Protocol (8 bits): Identifies the protocol of the data carried in the payload (the next-level protocol). Common values include 1 (ICMP), 6 (TCP), and 17 (UDP).
  • Header Checksum (16 bits): A checksum calculated only for the IP header. It’s used to detect errors (corruption) in the header during transmission. Since the TTL field changes at each hop, routers must recalculate and update the checksum.
  • Source IP Address (32 bits): The IPv4 address of the original sender of the packet.
  • Destination IP Address (32 bits): The IPv4 address of the final recipient of the packet.
  • Options (variable length, optional): If IHL > 5, this field contains one or more options, such as Security, Record Route (to list routers visited), or Timestamp. Options are not commonly used in typical internet traffic due to performance overhead. If options are present, padding (zeros) may be added to ensure the header length is a multiple of 32 bits.