The IPv4 Header

Introduction

Day 10 opens the IPv4 header the way Day 5 opened the Ethernet frame: every field has a job. Day 7 named Version, TTL, Protocol, and the two addresses. Today you add length, flags, the checksum, and the QoS byte so a capture, a traceroute hop, and a too-large ping all make sense.

A router reads this header before it cares about ports. It checks IHL, the header checksum, the remaining TTL, and the destination address. The host sets most fields. A normal forward only decrements TTL, recomputes the checksum, and may fragment when DF allows it.

Source and destination IP stay as the host wrote them. NAT is what rewrites addresses, and that comes later. Draw the 20-byte header, then tie `traceroute` to TTL, the protocol numbers to ICMP/TCP/UDP, and extended `ping` with DF to MTU.

Header as a forwarding contract

Treat the header as a forwarding contract. The minimum is 20 bytes (five 32-bit words). With options it grows in 4-byte steps to a maximum of 60 bytes. Bytes after that length are payload.

Row one is Version, IHL, the DSCP/ECN byte, and Total Length. Row two is Identification, Flags, and Fragment Offset. Row three is TTL, Protocol, and Header Checksum, followed by the source and destination addresses.

Forwarding matches the destination. TTL kills a routing loop. Protocol tells the receiver whether the payload is ICMP, TCP, or UDP. The checksum lets a router drop a corrupt header before trusting any of those fields.

Exam trap: Ethernet is a different contract. MAC addresses name the next hop on this LAN and change at every router. The IP addresses name the original sender and the final host. Mixing them up is how life-of-a-packet questions go wrong.

Version and IHL

Version is 4 bits and the value is 4. You never type it. In Wireshark it is the first nibble of Internet Protocol Version 4. A device that does not implement version 4 drops the packet.

IHL (Internet Header Length) is the next 4 bits, counted in 32-bit words, not bytes. IHL = 5 means 5 × 4 = 20 bytes, no options. IHL = 6 means 24 bytes. IHL = 15 means 60 bytes, so options are present and the payload starts later.

Exam misses: reading IHL as "5 bytes," or claiming every header is frozen at 20 bytes. The common packet is 20 bytes. Skip IHL × 4 bytes from the start of the IP header and you are on the ICMP, TCP, or UDP header.

DSCP and the ToS byte

The second byte used to be called Type of Service (ToS). Read it now as DSCP in the high 6 bits and ECN in the low 2 bits. DSCP is a QoS mark, a hint about queueing. ECN signals congestion. It is not a priority.

IP Precedence is the older 3-bit reading of the top of that same byte, so precedence still sits inside DSCP. Default traffic is DSCP 0 (best effort, CS0). Voice is often EF, DSCP 46. A mark does not by itself pick a route. Forwarding still uses the destination address.

Extended ping prompts `Type of service [0]:`. Leave it at 0 when you are testing reachability. A non-zero value is how you place a mark in this byte on a probe without writing a policy map. QoS configuration comes later; today you only need to know which byte it lives in.

Total Length and payload

Total Length is 16 bits and counts the whole datagram: header plus payload, in bytes. It is not the payload alone and not the Ethernet frame size. The minimum is 20. The maximum is 65,535.

Ethernet MTU 1500 caps this field at 1500 for an untagged frame. A 20-byte IP header leaves 1480 bytes above IP. A 20-byte TCP header then leaves a common MSS of 1460. ICMP's header is 8 bytes, so the ping data budget is smaller.

On IOS, extended-ping size is the ICMP data length. Default size 100 makes Total Length 20 + 8 + 100 = 128. Size 1472 fills a 1500-byte datagram: 20 + 8 + 1472. A VLAN tag or GRE header sits outside this field and can make a 1500-byte datagram stop fitting.

Identification

Identification is 16 bits, stamped by the sender. Every fragment of that datagram carries the same value, plus the same source, destination, and protocol. That set is how the receiver groups the pieces.

It is not a TCP sequence number and not a hop count. Senders usually increment it per datagram. The value does not have to be globally unique, because the reassembly key includes the addresses and the protocol.

In two captures of one routed flow, a matching Identification is evidence you found the same datagram after the MAC addresses changed. If the router fragmented it, you will see several packets with that ID and different offsets. You do not configure the field. You use it to tie fragments and captures together.

Flags and fragment offset

Three flag bits precede the Fragment Offset. Bit 0 is reserved. Bit 1 is DF (Don't Fragment). Bit 2 is MF (More Fragments). The offset is 13 bits, counted in 8-byte blocks, not raw bytes.

DF = 1 forbids fragmentation. If the datagram does not fit the next MTU, the router drops it and should return ICMP Destination Unreachable, fragmentation needed (Type 3, Code 4). Path MTU Discovery listens for that message.

MF = 1 means another fragment follows. The last fragment has MF 0. Offset 0 and MF 0 means the datagram was never fragmented. A non-zero offset is not the start of the payload. Every fragment except the last begins on an 8-byte boundary.

Reassembly is the destination host's job. Routers do not glue fragments back together just to forward them. If pieces never arrive, the host timer can send ICMP Time Exceeded, fragment reassembly (Type 11, Code 1).

TTL and loops

TTL is an 8-bit hop budget. Windows often starts at 128, Linux at 64, and packets IOS originates often at 255. Each forwarding router subtracts at least 1. At 0 it drops the packet and usually sends ICMP Time Exceeded (Type 11, Code 0) to the source.

A bridging switch does not decrement TTL. A multilayer switch decrements it only when it routes. That is why a routing loop dies: the packet expires, and the ICMP names the router where it died.

`traceroute` and Windows `tracert` send TTL 1, then 2, then 3. The router that expires each probe answers with Time Exceeded. IOS probes are UDP by default; Windows uses ICMP echo. `* * *` usually means that reply was filtered or had no route back.

Protocol field

Protocol is 8 bits and names the next header. Memorize 1 = ICMP, 6 = TCP, 17 = UDP, then 89 = OSPF, 88 = EIGRP, and 47 = GRE. These are IP protocol numbers, not ports.

Port 80 lives in the TCP header, and it matters only because Protocol is already 6. Protocol 17 means "hand this to UDP"; the UDP header carries the port. Ping is protocol 1. Echo request and echo reply are ICMP types 8 and 0, inside the ICMP header.

Routers forward without looking unless an ACL matches or the packet is for the router itself. OSPF hellos are protocol 89 aimed at the router. Exam trap: "protocol 17 means DNS." DNS is often UDP port 53. DHCP and SNMP are protocol 17 too.

Header checksum

The header checksum is a 16-bit one's-complement sum over the IPv4 header only. It does not cover TCP, UDP, or ICMP data. Those headers have their own checksums. The Ethernet FCS is a third check, a CRC over the frame.

Routers recompute it every hop because TTL changed. A failing checksum is discarded quietly: the source address in a corrupt header cannot be trusted for an ICMP error. `show ip traffic` counts checksum and format errors. A rising counter means corruption or a broken sender, not a missing route.

Exam trap: this field does not prove the payload was untouched. A device can alter the TCP segment and still write a valid IP header checksum. Payload integrity is the transport checksum, and later TLS. IPv6 removed the field. IPv4 still updates it on every hop.

Source and destination addresses

Source and destination are 32-bit addresses. The routing table matches the destination. The source is who receives the reply and any ICMP error. On a normal forward, neither address changes.

The next hop is the result of the lookup and the target of ARP. It is not written into the destination field. Replacing the destination with the next hop would kill the packet on that neighbor. ICMP errors go to the source, which is why a missing return route feels like a dead destination.

Standard forwarding ignores the source when it picks a route. Policy routing and unicast RPF are real, and they are not the default. If a diagram shows the destination IP changing at a router, that diagram is NAT or a mistake, not this day's forward.

Options and why CCNA stays high-level

When IHL is greater than 5, the extra bytes are options, padded to a 32-bit boundary. Historical options include record route, timestamp, and loose or strict source route. Source routing lets the sender name the routers to visit.

Options are rare, they consume MTU, and source routing can steer around a filter. Baselines include `no ip source-route` so the router ignores those packets. CCNA wants you to recognize that options exist and that IHL tells you where the payload starts. You do not memorize option type codes.

IHL 5 means there are no options. Spend the rest of the day on TTL, Protocol, DF, and the addresses. Those four explain forwarding, traceroute, and the MTU failures next.

Mapping show commands to fields

`show ip route` does not print header bits. Map commands to fields. `show interfaces GigabitEthernet0/0` reports the interface MTU (1500 on classic Ethernet) and input errors. That MTU caps Total Length on the way out.

`show ip interface GigabitEthernet0/0` shows the address and the IP MTU. `ip mtu 1400` lowers the IPv4 ceiling without changing the Layer 2 MTU, which matters when a tunnel eats bytes. `show ip traffic` counts bad hop count, unknown protocol, and fragment stats.

`traceroute 192.168.2.10` demonstrates TTL. Extended ping with a size and DF demonstrates Total Length and DF together. Wireshark is where Version, IHL, Identification, and the checksum are visible. A clean routing table does not prove a DF packet survived a too-small MTU.

MTU mismatch symptoms

A default ping hides MTU trouble. `ping 192.168.2.10` sends 100 bytes of ICMP data. The signature is specific: small packets work, large ones die when DF is set. Pages hang while ping still looks fine when Path MTU Discovery is broken.

Set extended-ping size to 1472 and answer yes to `Set DF bit in IP header?`. `ping 192.168.2.10 size 1472 df-bit` is the short form. That is a 1500-byte datagram. Size 1473 with DF set should fail, and IOS prints `M`.

The router that hits the smaller MTU should emit ICMP Type 3 Code 4. An ACL that filters it leaves the sender unable to shrink. GRE overhead creates the same symptom even when both physical interfaces still say MTU 1500. Fix the MTU or allow that ICMP before you clear DF as a habit.

Exam traps for the IPv4 header

TTL drops on routers, and on a switch only when that switch routes. Bridging does not touch it. Protocol is not a port: 6 is TCP, 17 is UDP, 1 is ICMP. Total Length includes the header. IHL is in 32-bit words; 5 means 20 bytes. Fragment offset is in 8-byte units.

DF plus a too-small MTU drops the packet while a 100-byte ping still succeeds. Reassembly belongs to the destination. The header checksum covers the header, changes every hop, and says nothing about the payload. The Ethernet FCS is a different trailer.

Source and destination IP survive each hop. The router rewrites Ethernet toward the next hop and leaves those addresses alone. Keep the MTU sum handy: IHL 5, ICMP 8, data 1472, Total Length 1500, DF set.