The IPv4 header is the Layer 3 protocol data unit (PDU) that enables routing of packets between networks, including across the Internet.
The IPv4 header encapsulates Layer 4 segments (TCP or UDP) and is itself encapsulated by the Layer 2 Ethernet frame.
The IPv4 header contains all the information needed for routers to forward packets to their destination, including addressing, fragmentation control, and error detection.
The minimum IPv4 header size is 20 bytes (without options), and the maximum is 60 bytes (with full options field).
Packet fragmentation occurs when a packet exceeds the Maximum Transmission Unit (MTU), typically 1500 bytes, and the IPv4 header contains multiple fields to manage reassembly.
Layer
PDU Name
Header Added
Layer 4
Segment
TCP or UDP header
Layer 3
Packet
IP header
Layer 2
Frame
Ethernet header + trailer
Field
Size
Purpose
Version
4 bits
Identifies IP version (4 or 6)
IHL
Header length in 4-byte units
DSCP
6 bits
QoS - traffic prioritization
ECN
2 bits
Congestion notification
Total Length
16 bits
Entire packet size in bytes
Identification
Links packet fragments
Flags
3 bits
Fragmentation control
Fragment Offset
13 bits
Fragment position
TTL
8 bits
Hop count limit
Protocol
Layer 4 protocol ID
Header Checksum
Header error detection
Source IP
32 bits
Sender's address
Destination IP
Receiver's address
Options
0-320 bits
Optional, rarely used
Internet Header Length (IHL): Specifies the IPv4 header length in 4-byte increments. Value of 5 = 20 bytes; Value of 15 = 60 bytes.
DSCP (Differentiated Services Code Point): Used for Quality of Service to prioritize delay-sensitive traffic like voice and video.
ECN (Explicit Congestion Notification): Signals network congestion without dropping packets; requires support from both endpoints and network infrastructure.
Total Length: The complete packet size (header + data) measured in bytes. Maximum value: 65,535 bytes.
Identification Field: A unique value assigned to all fragments of the same original packet for reassembly purposes.
Flags Field (3 bits):
Bit 0: Reserved (always 0)
Bit 1: DF (Don't Fragment) - prevents fragmentation when set to 1
Bit 2: MF (More Fragments) - set to 1 if more fragments follow; 0 for last/only fragment
Fragment Offset: Indicates the position of a fragment within the original packet, allowing out-of-order reassembly.
TTL (Time to Live): Decremented by 1 at each router hop; packet is dropped when TTL reaches 0, preventing infinite routing loops.
Header Checksum: Error detection for the IPv4 header ONLY (not the encapsulated data).
MTU (Maximum Transmission Unit): The largest packet size that can be transmitted; typically 1500 bytes for Ethernet.
Number
ICMP
1
TCP
6
UDP
17
OSPF
89
Measurement
Value
Minimum IPv4 header
20 bytes
Maximum IPv4 header
60 bytes
Maximum Options field
40 bytes
Standard MTU
1500 bytes
Maximum packet size
65,535 bytes
Default TTL
64
Binary
IPv4
0100 (4)
IPv6
0110 (6)
IHL Value
Header Size
5 (minimum)
15 (maximum)
IHL vs Total Length confusion:
IHL = header length in 4-byte increments
Total Length = packet length in bytes
Header Checksum scope:
Only checks the IPv4 header for errors
Does NOT check encapsulated data (TCP/UDP handles that)
TTL misconception:
Originally meant seconds, but actually represents hop count
Decremented by 1 at each router, not each device
More Fragments bit:
Set to 1 on all fragments EXCEPT the last one
Also set to 0 for unfragmented packets
Fragment reassembly location:
Fragments are reassembled at the receiving host, NOT by routers
Don't Fragment + Large Packet:
If DF bit is set AND packet exceeds MTU, the packet fails/is dropped
Protocol field confusion:
Memorize: TCP=6, UDP=17, ICMP=1, OSPF=89
Don't confuse TCP (6) with IPv6 (version 6)
Version: 4 (0100)
Header Length: 20 bytes (IHL = 5)
DSCP: 0 (no QoS marking)
ECN: 0 (not used)
Total Length: 100 bytes
Identification: 5
Flags: DF=0, MF=0
Fragment Offset: 0
TTL: 255
Protocol: ICMP (1)
Source: 192.168.1.1
Destination: 192.168.1.2
Original packet: 10,000 bytes MTU: 1500 bytes Result: Multiple 1500-byte fragments
All fragments share the same Identification value
All fragments except the last have MF=1
Each fragment has different Fragment Offset values
First fragment has Fragment Offset = 0
ping 192.168.1.2 SIZE 10000 → Creates fragmented packets
ping 192.168.1.2 df-bit → Sets Don't Fragment bit
ping 192.168.1.2 SIZE 10000 df-bit → FAILS (too large + can't fragment)
What is the size of the Version field in an IPv4 header?
What binary value is in the Version field for IPv4?
0100 (decimal 4)
What binary value is in the Version field for IPv6?
0110 (decimal 6)
What does IHL stand for?
Internet Header Length
How does the IHL field express header length?
In 4-byte (32-bit) increments
What is the minimum value of the IHL field?
5 (which equals 20 bytes)
What is the maximum value of the IHL field?
15 (which equals 60 bytes)
What is the minimum IPv4 header size?
20 bytes (no options)
What is the maximum IPv4 header size?
60 bytes (with maximum options)
What is the maximum size of the Options field?
40 bytes (320 bits)
What does DSCP stand for?
Differentiated Services Code Point
What is the DSCP field used for?
Quality of Service (QoS) - prioritizing delay-sensitive traffic like voice and video
How many bits is the DSCP field?
What does ECN stand for?
Explicit Congestion Notification
What is the purpose of the ECN field?
To signal network congestion without dropping packets
How many bits is the ECN field?
How many bits is the Total Length field?
16 bits (2 bytes)
What does the Total Length field measure?
The total length of the packet (header + encapsulated data) in bytes
What is the maximum value of the Total Length field?
What is the minimum value of the Total Length field?
20 bytes (minimum header, no data)
What is the purpose of the Identification field?
To identify which packet a fragment belongs to for reassembly
How many bits is the Identification field?
How many bits is the Flags field?
What are the three bits in the Flags field?
Bit 0: Reserved (always 0), Bit 1: Don't Fragment (DF), Bit 2: More Fragments (MF)
What does the DF (Don't Fragment) bit do when set to 1?
Prevents the packet from being fragmented
What does the MF (More Fragments) bit indicate when set to 1?
There are more fragments coming (current fragment is not the last)
What is the MF bit value on the LAST fragment?
0
How many bits is the Fragment Offset field?
What is the purpose of the Fragment Offset field?
To indicate the position of the fragment within the original packet for proper reassembly
Where are fragmented packets reassembled?
At the receiving host (not at routers)
What does TTL stand for?
Time to Live
How many bits is the TTL field?
What happens when TTL reaches 0?
The router drops the packet
What is the purpose of the TTL field?
To prevent infinite routing loops by limiting hop count
What is the recommended default TTL value?
What is the maximum TTL value?
255 (maximum 8-bit value)
When is the TTL decremented?
Each time the packet arrives at a router
What is the Protocol field used for?
To identify the encapsulated Layer 4 protocol
How many bits is the Protocol field?
What is the Protocol number for ICMP?
What is the Protocol number for TCP?
What is the Protocol number for UDP?
What is the Protocol number for OSPF?
How many bits is the Header Checksum field?
What does the Header Checksum verify?
Only errors in the IPv4 header (NOT the encapsulated data)
What happens if the Header Checksum doesn't match?
How are errors in encapsulated data detected?
By the Layer 4 protocol (TCP or UDP) using their own checksum fields
How many bits are the Source and Destination IP Address fields?
32 bits each
What is the typical MTU (Maximum Transmission Unit)?
What triggers packet fragmentation?
When a packet is larger than the MTU
What happens if the DF bit is set AND the packet exceeds the MTU?
The packet fails/is dropped (cannot be sent)
What is the Layer 3 PDU called?
What is the Layer 2 PDU called?
What is the Layer 4 PDU called?
What does PDU stand for?
Protocol Data Unit
In what order is the IPv4 header read?
Left to right, top to bottom
How do you calculate header length from IHL value?
Multiply IHL value by 4 (IHL × 4 = header length in bytes)
If IHL = 5, what is the header length?
20 bytes (5 × 4 = 20)
If IHL = 15, what is the header length?
60 bytes (15 × 4 = 60)
If IHL is greater than 5, what does that indicate?
The Options field is present
What is the default ping size on a Cisco router?
100 bytes
What command sends a 10,000-byte ping to 192.168.1.2?
ping 192.168.1.2 SIZE 10000
What command sets the Don't Fragment bit in a ping?
ping [IP address] df-bit
What happened to IPv5?
It was an experimental protocol called Internet Stream Protocol that was never publicly used
What is the Fragment Offset value of the first fragment?
IPv4 HEADER STRUCTURE (20-60 bytes)
┌─────────────────────────────────────────────────────┐
│ Version (4) │ IHL (4) │ DSCP (6) │ ECN (2) │ ← 32 bits
├─────────────────────────────────────────────────────┤
│ Total Length (16 bits) │ ← 32 bits
│ Identification (16) │ Flags (3) │ Frag Offset (13) │ ← 32 bits
│ TTL (8) │ Protocol (8) │ Header Checksum (16) │ ← 32 bits
│ Source IP Address (32 bits) │ ← 32 bits
│ Destination IP Address (32 bits) │ ← 32 bits
│ Options (0-320 bits) │ ← Variable
└─────────────────────────────────────────────────────┘
Last changed6 days ago