IP

Internet Protocol — the network layer

IPv4 Header RFC 791

0 4 8 16 24 31 Ver 4 bits IHL 4 bits TOS 8 bits Total Length 16 bits Identification 16 bits Flg 3 Fragment Offset 13 bits TTL 8 bits Protocol 8 bits Header Checksum 16 bits Source IP Address 32 bits Destination IP Address 32 bits 0-3 4-7 8-11 12-15 16-19 bytes
FieldSizeDescription
Version4 bitsAlways 4 for IPv4
IHL4 bitsHeader length in 32-bit words (min: 5)
TOS8 bitsType of Service / DSCP + ECN
Total Length16 bitsEntire packet size in bytes (max: 65535)
TTL8 bitsHop limit, decremented by each router
Protocol8 bitsEncapsulated protocol number

Protocol Numbers IANA Assigned

NumberProtocolDescription
1ICMPInternet Control Message Protocol
2IGMPInternet Group Management Protocol
6TCPTransmission Control Protocol
17UDPUser Datagram Protocol
41IPv6IPv6 encapsulation
47GREGeneric Routing Encapsulation
50ESPEncapsulating Security Payload
89OSPFOpen Shortest Path First

TTL Defaults Time To Live

Operating SystemDefault TTL
Linux64
macOS64
Windows128
Cisco IOS (routers)255
Solaris255
# Received TTL can fingerprint sender OS
# 64 - (64 - received) = hops traversed
# Example: TTL=52 means 12 hops from Linux host

Address Classes Classful (Historical)

0 Network Host Class A 10 Network Host Class B 110 Network Host Class C 0 8 16 24 32
ClassFirst OctetDefault MaskNetworks
A1-126/8 (255.0.0.0)128
B128-191/16 (255.255.0.0)16,384
C192-223/24 (255.255.255.0)2,097,152
D224-239MulticastN/A
E240-255ReservedN/A

CIDR Notation RFC 4632

192.168.1.0 network address / 24 prefix = 256 hosts
CIDRSubnet MaskHostsCommon Use
/32255.255.255.2551Single host
/30255.255.255.2522Point-to-point link
/24255.255.255.0254Small network
/16255.255.0.065,534Medium network
/8255.0.0.016,777,214Large network
/00.0.0.0AllDefault route

Special Addresses RFC 5735

AddressRangePurpose
0.0.0.00.0.0.0/8"This" network, default route
127.0.0.1127.0.0.0/8Loopback (localhost)
255.255.255.255-Limited broadcast
10.0.0.010.0.0.0/8Private (Class A)
172.16.0.0172.16.0.0/12Private (Class B)
192.168.0.0192.168.0.0/16Private (Class C)
169.254.0.0169.254.0.0/16Link-local (APIPA)
224.0.0.0224.0.0.0/4Multicast

Fragmentation Flags Field

0 reserved DF don't frag MF more frags 3 bits total
FlagValueMeaning
DF0May fragment
DF1Don't fragment (drop if too large)
MF0Last fragment
MF1More fragments follow
# Default MTU (Maximum Transmission Unit)
Ethernet: 1500 bytes
PPPoE:    1492 bytes
VPN:      ~1400 bytes (varies by overhead)