Internet Protocol (IP)

introductiontonetworking intro_to_network_traffic_analysis

The Internet Protocol (IP) add necessary information to data allowing routing and internetworking communication.

🐊ī¸ Port: N/A

đŸ—ēī¸ Used by: tcp, udp...

The IP protocol is using this header

IP Header

The size of the payload is TPL-IHL.

Packets may be fragmented đŸĒ“. Two fragmented packets must have:

  • the same source, destination, id, and protocol
  • every packet aside from the last one must have the flag MF (flag[+]), while the last one has the flag DF (flag[none]).
  • version đŸ”ĸ: 4 (IPV4), or 6 (IPV6)

  • IHL ✉ī¸: a quarter of the length of the header, which is usually 20 bytes (so, the IHL would be 5).

  • TPL đŸ“Ģ: the size of the entire packet in bytes

  • Fragment ID 🔑: identifier of the packet. Fragmented packets have the same fragment ID.

  • FLAG 👮:

    • 010 (DF): do not fragment
    • 001 (MF): more fragments are coming
    • 100 (X): reserved

  • Fragment Offset đŸŽ¯: index of this package payload in the un-fragmented data. This is the sum of the length of previously fragmented packet payloads. This value is in bytes (TPL divided by 8). For instance, the first fragment would have 0.

  • TTL 💀: decrease by one each time a packet transit by a host. The packet is destroyed when the TTL reaches 0. This exist to prevent infinite looping.

  • Protocol đŸ’ŗ: which protocol was used (1=ICMP, 6=TCP, 17=UDP...). See the list of IP protocol numbers.