This document summarizes the key fields in an IP version 4 packet header: 1) It contains fields for the version number, header length, type of service, total length, identification, flags, fragment offset, time to live, protocol, header checksum, source address, and destination address. 2) The version field indicates the IP protocol version (4 or 6). The header length field specifies the length of the IP header in 32-bit words. The total length field specifies the length of the entire IP packet or fragment. 3) The flags field contains bits for "Do not fragment", "More fragments", and reserved fields. This provides information about fragmentation of large packets.

1. IP Header (version 4)
Byte
Offset 0 1 2 3
0 IHL (Header
Version Type of Service (TOS) Total Length
Length)
4 IP Flags
Identification Fragment Offset
x D M
20
8 Bytes
Time To Live (TTL) Protocol Header Checksum
IHL
12 Source Address (Internet
Header
Length)
16 Destination Address
20 IP Option (optional, not common)
1 2 3
Bit 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
Nibble Byte Word
Version Protocol Fragment Offset IP Flags
Version of IP Protocol. 4 and IP Protocol ID. Including (but Fragment offset from start of x D M
6 are valid. This diagram not limited to): IP datagram. Measured in 8
represents version 4 1 ICMP 17 UDP 57 SKIP byte (2 words, 64 bits) x 0x80 reserved (evil bit)
structure only. 2 IGMP 47 GRE 88 EIGRP increments. If IP datagram is D 0x40 Do Not Fragment
6 TCP 50 ESP 89 OSPF
fragmented, fragment size M 0x20 More Fragments
9 IGRP 51 AH 115 L2TP
Header Length (Total Length) must be a follow
multiple of 8 bytes.
RFC 791
Number of 32-bit words in Total Length
TCP header, minimum value Header Checksum
Please refer to RFC 791 for
of 5. Multiply by 4 to get byte Total length of IP datagram, the complete Internet
or IP fragment if fragmented. Checksum of entire IP
count. Protocol (IP) Specification.
Measured in Bytes. header
Copyright 2004 - Matt Baxter - mjb@fatpipe.org