The IPv4 Header, Field by Field and in Order of Usefulness

The layoutThe header, laid out

Each row below is 32 bits, which is how the IPv4 header is always drawn and how the length field counts its size.

0                   1                   2                   3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-------+-------+---------------+-------------------------------+
| Ver   | IHL   | DSCP     | ECN|          Total length         |
+-------+-------+---------------+---+---------------------------+
|         Identification        |Flg|      Fragment offset      |
+---------------+---------------+---+---------------------------+
|      TTL      |   Protocol    |        Header checksum        |
+---------------+---------------+-------------------------------+
|                        Source address                         |
+---------------------------------------------------------------+
|                      Destination address                      |
+---------------------------------------------------------------+

Five rows of four bytes each, which is the minimum size of an IPv4 header. Everything after that is the data, which is usually a TCP or UDP header followed by the payload.

The six that matterThe six fields you actually meet

Every guide to the IPv4 header lists all twelve fields. These are the ones that come up in a working week.

The TTL field, time to live. An 8 bit counter, decremented by one at every router. At zero the datagram is discarded and an ICMP time exceeded message goes back to the sender.

It exists to stop a packet circling forever in a routing loop, and it is the entire mechanism behind traceroute, which sends packets with deliberately small TTLs so each router in turn announces itself.

It is also a rough fingerprint. Common starting values are 64 on Linux and macOS, 128 on Windows, and 255 on network equipment. A reply arriving with TTL 57 probably started at 64 and crossed seven routers.

The protocol field. An 8 bit value naming what is inside the IPv4 packet. This is why a firewall rule for a tunnel names a protocol rather than a port: IPsec in transport form is protocol 50, which has no ports at all, so a rule written in terms of ports matches nothing.

The DF bit. One bit in the three bit flags field, meaning do not fragment. When it is set, a router that cannot fit the datagram on the next link must discard it and return an ICMP error rather than fragmenting it.

That is path MTU discovery in one bit, and the reason a VPN tunnel opens and then hangs when the error is blocked.

The total length field. 16 bits covering the IPv4 header plus the data, so the theoretical maximum size of a datagram is 65,535 bytes. In practice the link MTU decides, which is why almost every packet you will ever see is 1500 bytes or less.

The DSCP field. Six bits marking how the packet should be prioritized, used by quality of service policies to put voice ahead of a file transfer.

The important operational fact is that these bits are only meaningful inside a network that agrees to honor the value: most providers rewrite or ignore them at the edge, so marking a datagram for priority does not mean it gets any once it leaves.

The source and destination address fields. 32 bits each, and the only fields most people think about. Worth noting for the same reason as DSCP: the source address is written by the sender and nothing in the IPv4 header verifies it, which is what makes address spoofing possible and why reflection attacks work.

The other sixThe fields you will probably never touch

The other six fields of the IPv4 header exist and rarely matter outside a packet capture.

The version field. Four bits holding the value 4. It is how a receiver distinguishes an IPv4 datagram from IPv6 on the same wire.

The IHL field, header length. Four bits counting the IPv4 header in 32 bit words. The value is 5 for a normal 20 byte header, and larger only when options are present. The maximum value of 15 is what caps the header size at 60 bytes.

The ECN field. Two bits letting a congested router mark a datagram rather than dropping it, so the sender slows down without losing any data. A good idea that took a long time to be widely enabled.

Identification, flags and fragment offset. The three fields that make fragmentation work. Every fragment of one original datagram carries the same identification value; the more fragments flag says whether another fragment follows; the fragment offset says where this piece of data belongs. The destination uses all three fields to reassemble it.

The header checksum field. Sixteen bits covering the IPv4 header alone, not the data, because TCP and UDP carry their own checksums over their own payloads. Every router has to recompute the value, because every router changes the TTL. That per hop cost is one of the reasons IPv6 removed the field entirely.

The options field. Variable length, almost never used, and frequently dropped or deprioritized by routers when it is. Anything relying on IPv4 options should be assumed not to work across the internet.

Against IPv6What IPv6 changed, and why

The IPv6 header is a useful mirror, because every difference is a deliberate decision about what the IPv4 header got wrong.

It is fixed at 40 bytes. Longer, because the addresses are four times the size, and fixed, because a variable header costs a router work on every packet.

There is no checksum field. Removed entirely. The layer below catches corruption and the layer above has its own checksum, so recomputing a header value at every hop bought very little.

The fragment fields moved out of the base header. IPv6 routers never fragment, and a sender that needs to uses an extension header, which keeps the common case simple.

Options became extension headers. Chained after the base header rather than embedded in it, so a router that does not care about them skips straight past.

PitfallsWhere people go wrong

Reading the TTL field as a time. It is a hop count, despite the name. Nothing about the value is measured in seconds on any modern network.

Writing a firewall rule with ports for a tunnel. ESP is protocol 50 and GRE is protocol 47, and neither has ports. A rule naming a port matches nothing at all.

Expecting DSCP markings to survive. They are honored inside networks configured to honor them and commonly rewritten at any boundary you do not control.

Trusting the source address. Nothing in the header authenticates it. Every reflection and amplification attack starts with a forged source address.

Assuming the checksum protects the data. It covers the IPv4 header only. Corrupted data in the payload is caught by TCP or UDP, or not at all.

Chasing IPv4 options. The field exists in the specification and is unreliable in practice, so any design that depends on it will work in the lab and fail on the internet.

Ignoring the DF bit while debugging a hang. A connection that opens and then stops on the first large transfer is that one bit meeting a smaller link, with the error blocked on the way back.

ComparisonThe two headers, and what every difference removes from a router

FAQFrequently asked questions

Keep readingRelated concepts

Read next · Protocols What Is ICMP? A TTL that reaches zero produces an ICMP time exceeded message, which is the whole of how traceroute works. Open this next11 min

• Diagnostics · 12 min Reading a Wireshark Capture Without Drowning in Packets The details pane decodes every one of these fields with its value labeled, which is the fastest way to learn them.
• Diagnostics · 12 min MTU and Fragmentation, and the Numbers Worth Memorizing The DF bit and the three fragment fields are one topic, and that page is where it is worked through.
• Protocols · 10 min The TCP Header, Field by Field, and What to Read in a Capture The other header in every packet, field by field.