PROTOCOLS-FUN . PACKET ANATOMY

IPv4 Anatomy

The IPv4 header (RFC 791), 20 bytes plus up to 40 bytes of options.

A real minimal (no-options) IPv4 header for a TCP segment from 192.0.2.1 to 198.51.100.10 (RFC 5737 documentation addresses). Shown bit-by-bit because Version/IHL and the fragmentation word don't fall on byte boundaries.

IPv4 header - 20 bytes / 160 bits

The header checksum below is real: re-summing all ten 16-bit words with this value included folds to zero (verified).

The second byte was originally "Type of Service"; RFC 2474/3168 redefined it as 6 bits of Differentiated Services Code Point (which QoS class) plus 2 bits of Explicit Congestion Notification. Shown here set to EF (Expedited Forwarding) - the class voice traffic uses.

Differentiated Services byte (8 bits)

Identification, Flags, and Fragment Offset are how a datagram too big for a link's MTU gets split and reassembled. This is the middle fragment of a datagram: same Identification as its siblings, MF (more fragments) set, and an offset placing its payload at byte 1480 of the original.

Identification + Flags + Fragment Offset (32 bits)

Fragmentation is largely deprecated in practice. The Fragment Offset counts in 8-byte units (13 bits x 8 = 65528-byte reach), which is why every fragment except the last must be a multiple of 8 bytes. On-path fragmentation is now avoided in favor of Path MTU Discovery (the router sends ICMPv4 Destination Unreachable, code 4 instead), and IPv6 removed router fragmentation entirely.

When IHL is greater than 5, one or more 32-bit option words follow the base header. This one carries a single Router Alert option (RFC 2113): "every router on the path must inspect this packet, not just forward it" - used by protocols like RSVP and IGMP. Shown byte-by-byte since options are byte-structured.

IPv4 header with Router Alert option - 24 bytes

IHL is now 6 (byte 0 = 0x46) and the checksum is recomputed over the larger header - verified to fold to zero.