So looking at an IP packet consisting of a header section and a data section.
We'll see that the IPV four packet header consists of 14 fields and only the options field is well,
optional.
Now I'm not going to talk about each field one by one, but I'll give you a few short explanations of
some of the more pertinent ones.
The version field is always equal to four y.
IPV four.
The Internet header length field is the size of the header in words where word is always going to be
32 bits.
The total length is the entire packet size.
In this case, it's in bytes.
As you know.
But to catch up to speed, one byte is eight bits.
The minimum size is 20 bytes.
So that's a header without data and the maximum is 65,535 bytes.
The flag is used to determine the fragmentation options.
Bit one is DF or don't fragment if it's set.
And I mean by that if this bit is one and fragmentation is required to route the packet, then the packet
is dropped.
Bit two is MF or more fragment for fragmented packets.
All fragments except the last have the MF flag set.
Bit zero is reserved for the future.
TTL or Time to Live.
Is to limit the lifetime of a packet.
It's a hop count.
Basically, when the packet arrives at a router, the router decrements the TTL field by one.
Protocol field is the protocol used in the data portion of the IP packet.
So that's going to be TCP, UDP, ICMP.
Source address and destination address fields are the most important fields of an IP header.
These fields are the IPv4 address of the sender of the packet and the IPv4 address of the receiver of
the packet.
Please note that this address may be changed in transit by a network address translation device.
We'll talk about that later.
This is how an IPV four packet is seen on Wireshark.
So it's a DNS query response.
The fields we mentioned are seen pretty clearly.
Versions for.
At her length is five words, which means no options.
Field.
Total length is 96 bytes.
MF and DF flags are not set.
And you can see the source and the destination addresses and all the rest.