IPv4 Header
IPv4 Header 관련
Now that you understand IP addresses, subnets, and special addresses, it's time to examine the IPv4 header structure in detail.
The Header Structure
(Source:
BriefVid)The diagram above shows the header of IPv4 as defined in RFC 791. Let's examine each field:
Version (4 bits)
(Source:
BriefVid)The header starts with the Version field, which consists of four bits. For an IPv4 packet, the version is 4, so this field will always carry the value of 4 (or 0100 in binary).
❓ Why does the header start with the Version field? 🤔
Note
when I start a sentence with the ❓mark – it’s a question addressed at you, and I encourage you to try and answer it before reading on
The reason is that the remaining fields may differ according to the version. If a network device reads an IP packet and the version field carries the value of 4, it will expect the remainder of the packet to follow the IPv4 structure. If it carries another value, such as 6, the remaining fields are different, as in IPv6. #### Internet Header Length (IHL) (4 bits)
(Source:
BriefVid)This field indicates the length of the header itself.
❓ Why do we need to specify the length? 🤔
Unlike Ethernet, where the header size is fixed, the IPv4 header length can vary because of optional fields. For an IP packet without special options, the header consists of 20 bytes, which is the most common case.
The IHL field doesn't specify the length in bytes directly but in units of 4-byte words. So to specify a length of 20 bytes, the value would be 5 (5 × 4 = 20). This encoding allows the field to use only 4 bits while specifying header lengths up to 60 bytes (when IHL = 15).
A common IPv4 packet therefore begins with the byte 0x45 in hexadecimal, meaning it's version 4 of the IP protocol, and the header is 20 bytes long.
Type of Service (TOS) (8 bits)
(Source:
BriefVid)The idea behind this field is that not all packets are equally important. You may want to give priority to some packets over others.
For example, packets carrying real-time data (like voice or video conferencing) are more time-sensitive than packets carrying, say, email or file downloads. If a router is currently experiencing high load, it should ideally prioritize time-sensitive packets.
The Type of Service field allows senders to indicate the priority of their packets. However, on the public internet, this field is often ignored by routers because any sender can set any priority value. In most cases, this field carries the value of 0.
Total Length (16 bits)
(Source:
BriefVid)This field specifies the total length of the IP packet, including both the header and the payload (data).
❓ Why is this needed to specify the length? 🤔
Unfortunately, the IP layer doesn’t necessarily know if some of the bytes in the packet are actually a padding of the second layer. I described this in detail in a previous post, where I showed that in Ethernet protocol, in some cases, the receiving Ethernet entity cannot tell which bytes belong to the payload and which bytes are simply padding. The IP layer needs to know precisely which bytes belong to the actual packet, hence the Total Length field.
❓ What is the maximum size of an IPv4 packet? 🤔
Since this field is 16 bits long, an IPv4 packet may contain a maximum of 2^16-1 bytes, or 65,535 bytes, including the header. The minimum size is 20 bytes, consisting of just the header without options or payload.
Fragmentation Fields (32 bits)
(Source:
BriefVid)The next four bytes are dedicated to fragmentation control. I’ll cover these fields in a separate section, as they involve a complex topic deserving special attention.
Time to Live (8 bits)
(Source:
BriefVid)Despite its name, this field doesn't actually measure time but rather the maximum number of routing hops a packet can traverse before being discarded.
To understand its purpose, consider this scenario: If Machine A sends a packet to Machine B through a series of routers, but there's a routing loop where Router 2 sends to Router 3, which sends to Router 4, which sends back to Router 2, the packet could circulate indefinitely, consuming bandwidth and never reaching its destination.
(Source:
BriefVid)The TTL field prevents this by setting a limit on how many hops a packet can take:
- The sender sets an initial TTL value (often
64or128) - Each router that handles the packet decrements the TTL by
1 - If a router receives a packet with TTL =
1, it decrements it to0and discards the packet - The router then sends an ICMP "Time Exceeded" message back to the original sender
This doesn't solve the underlying problem of routing loops, but it prevents packets from circulating forever.
In IPv6, this field is renamed "Hop Limit," which more accurately describes its function.
Protocol (8 bits)
(Source:
BriefVid)This field describes the payload of the IPv4 packet. For example:
- A value of
6means the payload is TCP - A value of
17means the payload is UDP
This helps the receiving system know which protocol handler should process the packet's contents. It's similar to the Type field in Ethernet, which specifies the protocol of the layer encapsulated within the Ethernet frame.
Header Checksum (16 bits)
(Source:
BriefVid)This is a 16-bit checksum used to verify the validity of the header only (that is, excluding the payload). The sender computes this value based on the fields of the header, and the receiver also computes it to validate that the header was received correctly.
❓The checksum must be recalculated by each router. Why is that? 🤔
Because the TTL field changes at each hop. For example, if a packet starts with TTL = 7, each router will:
- Verify the current checksum based on TTL =
7 - Decrement TTL to
6 - Calculate a new checksum based on TTL =
6 - Forward the packet with the new checksum
If the checksum verification fails, the device drops the packet. This prevents packets with corrupted headers (which might have incorrect destination addresses, for instance) from being forwarded.
Source and Destination Addresses (32 bits each)
(Source:
BriefVid)These fields contain the source and destination IPv4 addresses, respectively. Each is 4 bytes (32 bits) long, as you learned in the previous sections on IPv4 addressing.
Options (Variable Length)
(Source:
BriefVid)Most IPv4 packets don't include options, but when present, they can provide additional functionality:
- Record Route: Each router that handles the packet adds its own address to this option, creating a trace of the packet's path
- Source Routing: Allows the sender to specify the route the packet should take:
- Strict Source Routing: The entire route must be followed exactly
- Loose Source Routing: Certain routers must be traversed, but the exact path between them is flexible
Padding
In some cases, the header ends with padding bytes (usually 0s).
❓Why does the IPv4 header have padding?🤔
As explained before, the IHL field specifies the header length in 4-byte units, so the total header length must be a multiple of 4 bytes. If options make the header length not divisible by 4, padding bytes (usually 0) are added to reach the next multiple of 4. For example, if you have 3 bytes of options, you would need 1 byte of padding to make the total header length a multiple of 4 bytes.
IPv4 Header – Interim Summary
You've now learned about the structure of the IPv4 header, with the exception of the fragmentation fields which I’ll cover in the next section.
The IPv4 header efficiently packs all the necessary routing and control information into a compact structure, typically 20 bytes long (without options). This design allows for fast processing by routers while providing the flexibility needed for internet communication. It is amazing how prominent IPv4 is, even so many years after its publication.
In the next section, you'll learn about IPv4 fragmentation.