Now, something else that you're really going to need to know backwards and forwards is the IP header
fields.
Of course, this is critical because so many attacks are going to involve elements of these headers.
Now the IP header, remember, its whole job is to encapsulate additional network layer information
onto the data.
So there is this IP header that is encapsulated onto the data at the network layer.
There's a transmission control protocol header that would be attached if this traffic was using transmission
control protocol.
How do you know if the traffic needs to use transmission control protocol?
Well, you'll learn that in a moment.
So it all begins with this 14 fields, 13 of which are required.
And this is where we start to get into a crappy.
That's right.
I said a crappy thing about IP version four, and that is that we can have a variable length header
that's not good that places strain on the entire system.
Routers have to deal with these variable length headers.
All our network devices have to deal with the header of a variable length, which is trickier then a
fixed length header, which is exactly what IPv6, the next generation of TCP IP brings us.
So any ways stuck with this format?
We have 14 fields, 13 of which are required.
We have an options field that could throw that off.
There's options that could be added, which is why 13 are required.
The one field options field is optional.
All right.
Let's go through the fields.
They are critically important.
There's the four bit version field.
This is a snooze fest because this is always going to be set to four for this version for traffic,
the internet header length notice the Internet header length, four bits.
This is another field that's only required because of a variable length header.
Yuck.
Next up, the DSC P six bits.
These bits and the two bits that follow used to be the eight bits of what we call the type of service
byte.
This is now broken up into the differentiated services code point or control point and the explicit
congestion notification.
What these two settings are all about is quality of service.
The DSP six bits can indicate the priority of the traffic and how the traffic should be treated on a
hot by heart basis.
For example, voice over IP traffic would get the very highest possible DHCP bit settings so that it
would be identified as voice over IP.
The explicit congestion notification bits are for just that one node notifying another node that it
is congested and please slow down.
The IP header.
Next field that we need to discuss is the total length field.
16 bits.
Another field that sucks and is only there because of the fact that it is a variable length header.
Next up, we have the identification.
This is critical for fragmentation.
So if packets are going to be fragmented, the ID field can be used to help group fragments.
Next up, we have the flags.
It's important to know the flags.
Three bits here.
There's one reserved.
You can't use it.
And then don't fragment or must fragment.
So we have these related to fragmentation.
So the flags in the IP header are directly related to fragmentation.
Next up, the fragment offset.
So because fragments, packets can be fragmented, the fragment offset.
Allows us to determine exactly where the fragmentation is occurring in the packet.
Next up, the time to live.
This is so critical in the IP header.
This is a countdown to zero, which means the packet gets thrown away.
This is our loop protection mechanism.
So as each router passes the IP header from router to router, they are decrement ding the time to live
down from 255.
And when it gets to zero, that's it.
The packet gets dropped.
The protocol field.
This is a great field.
This is kind of the glue matching this encapsulated data to some other protocol.
For instance, UDP, which is.
Ah, let me see.
UDP is protocol number 17, I believe, and TCP is protocol number six.
I might have those reversed, but it's been a while since I've looked at those protocol numbers.
But you get the idea and I will have that corrected in a moment.
But the protocol field is going to indicate what protocol is going to be utilized.
The header checksum.
Any time you see the word checksum, you know it's about error correction and error checking.
And that's exactly what that field is doing.
And I just checked imagine that I was correct.
Six is TCP and 17 is UDP.
I remember that order, I guess because the lower number, the more common TCP and then the higher number
of 17 associated with UDP, less common.
Oh, let's see.
What else?
Oh, yeah.
The source IP address.
We got to keep going here in our story.
Now, that's a 32 bit source IP address.
Duh.
And then a 32 bit destination.
IP address.
Duh.
Double duh.
And then the options field.
This is a variable playing field that doesn't need to be used, and it often is not.
So these are the important fields that make up the IP header, and I hope you have a new sense for all
the information that gets encapsulated on to the data in order for a packet to make its way successfully
from point A to point B.