11.1 IPv4 Packet Structure

IPv4 Packet Structure

IPv4 packets are the fundamental units of data transmission across IP networks. Every piece of data you send or receive on the internet gets wrapped in an IPv4 packet, and the header attached to that packet tells routers everything they need to know: where the data came from, where it's going, how big it is, and how to handle it along the way.

The IPv4 header packs a lot of functionality into a compact structure. It handles addressing, fragmentation, loop prevention, error detection, and quality of service. Understanding each field and how they work together is essential for reasoning about how packets actually move through a network.

Fields of the IPv4 Header

The IPv4 header is made up of several fields, each serving a specific purpose. Here's what each one does:

• Version (4 bits): Specifies the IP version. For IPv4, this value is always 4.
• Internet Header Length (IHL) (4 bits): Indicates the length of the header measured in 32-bit words. The minimum value is 5 (meaning 20 bytes with no options), and the maximum is 15 (60 bytes).
• Type of Service (ToS) / Differentiated Services Code Point (DSCP) (8 bits): Used for quality of service (QoS) and packet prioritization. Routers can use this field to give preferential treatment to time-sensitive traffic like voice or video.
• Total Length (16 bits): The total size of the entire IP packet (header + data), measured in bytes. The maximum value is 65,535 bytes.
• Identification (16 bits): A unique identifier assigned by the sender. When a datagram gets fragmented, all fragments share the same Identification value so the receiver can reassemble them correctly.
• Flags (3 bits): Control fragmentation behavior.
  • Bit 0: Reserved (always 0)
  • Bit 1: Don't Fragment (DF) — if set, routers must not fragment this packet. If the packet is too large for a link and DF is set, the router drops it and sends an ICMP error back.
  • Bit 2: More Fragments (MF) — set to 1 on all fragments except the last one, so the receiver knows more pieces are coming.
• Fragment Offset (13 bits): Indicates where this fragment belongs within the original datagram, measured in units of 8 bytes. The receiver uses this to place fragments in the correct order during reassembly.
• Time-to-Live (TTL) (8 bits): Limits how long a packet can exist in the network. Decremented at each router hop; when it hits 0, the packet is discarded. More on this below.
• Protocol (8 bits): Identifies which transport-layer protocol the data payload uses. Common values include 6 for TCP and 17 for UDP.
• Header Checksum (16 bits): Used for error detection on the header only. Covered in detail below.
• Source Address (32 bits): The IP address of the sender (e.g., 192.168.1.1).
• Destination Address (32 bits): The IP address of the intended recipient (e.g., 10.0.0.5).
• Options (variable, optional): Provides additional functionality such as source routing, record route, or timestamps. Because Options can vary in length, the IHL field is needed to tell routers where the header ends and the data begins.

TTL and Packet Loop Prevention

Routing loops can occur due to misconfigurations or convergence delays in routing protocols. Without a safeguard, a packet caught in a loop would circulate forever, wasting bandwidth and potentially causing congestion.

TTL solves this problem. It's an 8-bit field, so its maximum value is 255. Here's how it works:

1. The sender sets the TTL to an initial value (commonly 64 or 128, depending on the operating system).
2. Each router that forwards the packet decrements the TTL by 1.
3. If the TTL reaches 0 before the packet arrives at its destination, the router discards the packet.
4. The router then sends an ICMP Time Exceeded message back to the source address, informing the sender that the packet was dropped.

This mechanism is also what makes traceroute work. By sending packets with incrementally increasing TTL values (1, 2, 3, ...), each successive router along the path reveals itself through its ICMP Time Exceeded reply.

Network vs. Host Portions of IP Addresses

Every IP address is divided into two logical parts: the network portion and the host portion. The network portion identifies which network a device belongs to, while the host portion identifies the specific device within that network.

The subnet mask determines where the boundary falls between these two parts. A subnet mask is a 32-bit value consisting of contiguous 1s followed by contiguous 0s:

• The bits set to 1 correspond to the network portion of the address.
• The bits set to 0 correspond to the host portion.

For example, with a subnet mask of 255.255.255.0 (in binary: $11111111.11111111.11111111.00000000$), the first 24 bits are the network portion and the last 8 bits are the host portion. For the address 192.168.1.50 with this mask, 192.168.1 identifies the network and .50 identifies the specific host.

You can determine the network address by performing a bitwise AND between the IP address and the subnet mask. Two devices are on the same network if their network portions match.

Header Checksum for Error Detection

The header checksum is a 16-bit field that detects errors in the IP header caused by transmission problems like bit flips or electrical interference. It protects the header only, not the data payload. (Transport-layer protocols like TCP and UDP have their own checksums for the data.)

How the sender calculates the checksum:

1. Set the checksum field to 0.
2. Treat the entire header as a sequence of 16-bit words.
3. Add all the 16-bit words together using one's complement addition (any carry out of the most significant bit gets added back to the least significant bit).
4. Take the one's complement (flip all the bits) of the resulting sum.
5. Place this value in the checksum field.

How each router and the receiver verify it:

1. Perform the same one's complement sum over all 16-bit words in the header, including the checksum field.
2. If the result is all 1s ($0xFFFF$), the header is valid.
3. If the result is anything else, the header has been corrupted and the packet is discarded.

Because the TTL field changes at every hop (it gets decremented), routers must recalculate the header checksum each time they forward a packet. This is one reason IPv6 removed the header checksum entirely, to reduce per-hop processing overhead.