IPv4 Header | Day-10

• IPv4 header

  Always has a value of 4
• IPv6

  Identified with a value of 6, or 0 1 1 0 in binary
• IPv5 was an experimental protocol called Internet Stream Protocol with an Internet Protocol value of 5, but it was never publicly used
• The minimum value in the IHL field is 5, equal to 20 bytes, which is the length of the IP packet without any IP options at the end
• The maximum value in the IHL field is 15, equal to 60 bytes, which is the maximum length of the IP options field
• IPv6 header

  Has a different structure than the IPv4 header if the value of the header field is 6
• Internet Header Length (IHL)

  4 bits in length, necessary to indicate the total length of the header in 4-byte increments
• An IPv4 header with a maximum length options field, 40 bytes, has a length of 60 bytes, the maximum length of an IPv4 header
• DSCP (Differentiated Services Code Point)

  6 bits in length, used for Quality of Service (QoS) to prioritize delay-sensitive data
• An IPv4 header with no options field is 20 bytes in length, the minimum length of an IPv4 header
• ECN (Explicit Congestion Notification)

  2 bits in length, provides end-to-end notification of network congestion without dropping packets
• Total Length field

  16 bits in length, indicates the total length of the packet, including the IPv4 header and the encapsulated Layer 4 segment
• The Total Length field indicates the length in bytes, not in 4-byte increments like the IHL field
• The maximum value in the Total Length field is 65,535, the maximum length of an IPv4 packet
• The minimum value in the Total Length field is 20, meaning 20 bytes, which is equal to a minimum-sized IPv4 header with no encapsulated data
• The maximum length of an IPv4 packet is 65535
• Identification field

  16 bits in length, used to identify fragmented packets for reassembly
• Fragments are reassembled by the receiving host
• Flags field

  3 bits in length, used to control and identify fragments: Bit 0 reserved and always set to 0, Bit 1 (DF bit) set to 1 means the packet should not be fragmented, Bit 2 (MF bit) set to 1 if there are more fragments, set to 0 for the last fragment
• Packets are fragmented if larger than the MTU (Maximum Transmission Unit), usually 1500 bytes
• Fragment offset field

  13 bits in length, indicates the position of the fragment within the original unfragmented IP packet for reassembly
• Time to Live Field

  8 bits in length, used to prevent infinite loops by dropping packets with a TTL of 0, indicates the packet's maximum lifetime in seconds (actually a 'hop count')
• Current recommended default TTL is 64
• Protocol field

  8 bits in length, indicates the protocol of the encapsulated Layer 4 PDU: TCP (6), UDP (17), ICMP (1), OSPF (89)
• Header checksum field

  16 bits in length, calculated checksum used to check for errors in the IPv4 header
• TCP protocol number is 6, UDP protocol number is 17, ICMP protocol number is 1, OSPF protocol number is 89
• The header checksum is only used to check for errors in the IPv4 header, not in the encapsulated data
• The header checksum field in IPv4 is 16 bits in length and is used to check for errors in the IPv4 header
• When a router receives a packet

  It calculates the checksum of the header and compares it to the one in the header's checksum field. If they do not match, the router drops the packet
• The destination IP address field indicates the IPv4 address of the intended receiver of the packet
• Both UDP and TCP, the two Layer 4 protocols, have checksum fields to check for errors in the encapsulated data
• The source IP address field indicates the IPv4 address of the sender of the packet
• The Source and Destination IP Address fields in IPv4 are 32 bits in length each
• Wireshark is an extremely useful tool for learning and troubleshooting network problems
• If the Internet header length (IHL) field is greater than 5, it means that options are present
• The options field in the IPv4 header is optional and can be 0 bits if not used, or up to 320 bits (40 bytes) in length
• Wireshark can be used to examine network traffic and packet captures
• ICMP is the protocol used by ping
• Wireshark packet captures can help in studying network traffic
• The Version field in the IPv4 header indicates version 4