InetDaemon.Com

The term 'datagram' or 'packet' is used to describe a chunk of IP data. Each IP datagram contains a specific set of fields in a specific order so that the reader knows how to decode and read the stream of data received. The description of the IP datagram format in this tutorial is suitable for most purposes.

An IP datagram looks something like this:

VERSION (4 bits)

The version field is set to the value '4' in decimal or '0100' in binary. The value indicates the version of IP (4 or 6, there is no version 5).

IHL (4 bits)

The Internet Header Length (IHL) describes how big the header is in 32-bit words. For instance, the minimum value is 5, as that is the minimum size of an IP header that contains all the correct fields is 160 bits, or 20 bytes. This allows the receiver to know exactly where the payload data begins.

TOS (8 bits)

Type of service allows the intermediate receiving stations (the routers) to have some notion of the quality of service desired. This allows the network to make adaptations for delay, throughput, or reliability.

TOTAL LENGTH (16 bits)

This informs the receiver of the datagram where the end of the data in this datagram is. This is the length of the entire datagram in octets, including the header. This is why an IP datagram can be up to 65,535 bytes long, as that is the maximum value of this 16-bit field.

IDENTIFICATION (16 bits)

Sometimes, a device in the the middle of the network path cannot handle the datagram at the size it was originally transmitted, and must break it into fragments. If an intermediate system needs to break up the datagram, it uses this field to aid in identifying the fragments.

FLAGS (3 bits)

The flags field contains single-bit flags that indicate whether the datagram is a fragment, whether it is permitted to be fragmented, and whether the datagram is the last fragment, or there are more fragments. The first bit in this field is always zero.

FRAGMENT OFFSET (13 bits)

When a datagram is fragmented, it is necessary to reassemble the fragments in the correct order. The fragment offset numbers the fragments in such a way that they can be reassembled correctly.

TIME TO LIVE (8 bits)

This field determines how long a datagram will exist. At each hop along a network path, the datagram is opened and it's time to live field is decremented by one (or more than one in some cases). When the time to live field reaches zero, the datagram is said to have 'expired' and is discarded. This prevents congestion on the network that is created when a datagram cannot be forwarded to it's destination. Most applications set the time to live field to 30 or 32 by default.

PROTOCOL (8 bits)

This indicates what type of protocol is encapsulated within the IP datagram. Some of the common values seen in this field include:

Protocol	Number (Decimal)
ICMP	1
IGMP	2
TCP	6
UDP	17

HEADER CHECKSUM (16 bits)

According to RFC 791, the header checksum formula is:"the 16-bit ones compliment of the ones compliment sum of all 16-bit words in the header."

The checksum allows IP to detect datagrams with corrupted headers and discard them. Since the time to live field changes at each hop, the checksum must be re-calculated at each hop. In some cases, this is replaced with a cyclic redundancy check algorithm.

SOURCE ADDRESS (32 bits)

This is the IP address of the sender of the IP datagram.

DESTINATION ADDRESS (32 bits)

This is the IP address of the intended receiver(s) of the datagram. If the host portion of this address is set to all 1's, the datagram is an 'all hosts' broadcast.

OPTIONS & PADDING (variable)

Various options can be included in the header by a particular vendor's implementation of IP. If options are included, the header must be padded with zeroes to fill in any unused octets so that the header is a multiple of 32 bits, and matches the count of bytes in the Internet Header Length (IHL) field.