The Network Layer:

IPv4 Header Processing

Understanding the role of the
header for network aware devices
ECPI University - School of Technology
Department of Computer Information Sciences
mtaylor
v2013.5

Objectives
Familiarize student with IP Header fields
Learn how the fields control the handling
of data
Learn how Source and Destination
addresses are handled by the local
machine
Use Troubleshooting Tools related to IP

IP Features
OSI Layer 3 Protocol
Connectionless
needs TCP to add connection oriented
functions
Best effort delivery, no retransmit attempt

Is capable of using hierarchical

addressing
MAC addresses are not capable of this

Context of IP Header
Frame
Header

Packet
Header

Transport Data
Header

type=ip
0800

5x32 bits 6x32 bits

20 bytes 24 bytes

Trailer

1500bytes

Header fields = set of instructions

Tells network aware devices how to handle the data being sent.
Frame Header is followed by the Packet header
If protocol field in the frame header is set to 0800, it means that
IP will be the next protocol to process the data stream.
After the IP Packet Header is processed, the host machine examines
the Transport Layer Header for further instructions.

IPv4 Header Details

Frame
Header

Packet
Header
5x32 bits

Transport
Header

Data

Trailer

1500bytes

Though this graphic is presented in 32 bit lines organized as fields, the node
sees a single string of bits.
Bits are counted off and organized into the fields seen here.

The IP Header

5 x 32 bit lines of code (a string of at least 160 bits)

13 separate header fields (variable lengths)
Each field is assigned a specific number of bits

Each field is calculated by the network device to discover the

number that the field produces
The number is then used as a variable in the network driver
program code.
The variable determines how to process the data fields

Version Field

First 4 bits
can be ordered in 2^4th power (16 bit) patterns

Tells the TCPIP node what version of IP is being used

Version 4 (0100)
Version 6 (0110)

Important to know because IPv4 uses a 32 bit address and IPv6 has 128 bits
Each version has a different number of fields and different uses for them

Header Length Field

4 bits
Tells the TCPIP node what how many bytes of data are in the header, in this
case there are 5 lines of 32 bits, the bit number is set to 1001
This tells the node to count off 160 total bits before it comes to the transport
layer header

Differentiated Services Code Point

8 bits long
6 bits=Differentiated Services Code Point ( DSCP or just DS)
Allows VOIP or Streaming Media to have higher delivery priorities to avoid
delays resulting in choppy reception
Replaces older Type of Service field
Often associated with Quality of Service (QoS)

2 bits=Explicit Congestion Notification

Not often used, but can provide source/destination alerts when traffic is
heavy

Type of Service:TOS
http://www.oreilly.com/catalog/coreprot/chapter/ch02.html#13340
Value

Service

Description

Normal

IP datagram is treated as a normal datagram, and not given any special handling.
Datagrams are usually marked with all zeroes in the Type-of-Service field.

Minimize Delay

Delay flag is used to request IP to route this packet over a network that provides
lower latency than normal. It may be set to either 0 (normal) or 1 (low delay).

Maximize
Throughput

Throughput flag requests that IP route this packet over a network that provides
higher throughput than normal. This flag may be set to 0 (normal) or 1 (high
throughput).

Maximize
Reliability

Reliability flag requests that IP route this packet over a network that provides the
most reliable service. The Reliability flag may be set to 0 (normal) or 1 (high
reliability).

Minimize Cost

Cost flag was added by RFC 1349 and was not defined in RFC 791. For this
reason, many systems do not recognize or use it. The Cost flag is used to
request that IP route this packet over the least expensive route available.

15

Maximize
Security

RFC 1455--an experimental specification for data-link layer security--states that

this flag is used to request that IP route this packet over the most secure path
possible.

Total Length Field

16 bits long
Tells the TCPIP node what how many bytes of data are in the entire packet including
the data.
Tells system to look for 150 bytes of data (170TLBytes-20 IHL bytes)
Example: a hexadecimal number of 00 AA would tell the system to look for 170 bytes
of data in the packet

Identification Field

16 bits long
Provides a packet number so that if identical packets are
received, the extra copies can be discarded
Multiple packets could be received with wireless systems
reflecting packets off multiple surfaces.

Flags Field

3 bits long
Tell if fragmentation is set
Fragmentation is not used very often

Fragment Offset Field

13 bits long
Used when total length exceeds the maximum
transmission unit size defined by the interface

Time To Live (TTL) Field

8 bits/max value of 255

Number of routers the packet can cross before it dies
Decrements by 1 for each router it crosses

Protocol Field

8 bits/max value of 255

Tells the node what process to send the segment to at the transport
layer:
1= ICMP (ping),
6=TCP
17 = UDP

Header Checksum Field

16 bits
Tells the node how to mathematically compare the sent packet with
the received one to verify that the data is intact
The checksum send must agree with the checksum received

Source IP Address Field

32 bits
Tells the node where the data packet came from
If data acknowledgements are sent or data requests are being
returned, this become the destination address in the return packets

Destination IP Address Field

32 bits
Tells the node where the data packet was intended to go.
The receiving node must see its own address in this field in order to
process the data further. Otherwise, it drops the packet and does
not respond to other nodes any further about the packets contents.

Summary
The packet header tells the TCPIP software how
to handle the routing of the data to the right
network
Fields in the header are defined by bits in a
particular location in the header
Each field is interpreted by the software based
on the bit pattern it sees.
Bit patterns are matched up against a list of
actions to be taken
The Source and Destination IP Address fields
make the Packet Header important to routers