IPv4 header // RFC 791

The twenty-byte baseline that still carries most of the internet. The header is a fixed set of fields followed by an optional TLV list; everything else is payload. Hover any block to get its bit range, allowed values and the clause that defines it.

RFC 791 · IPv4 RFC 2474 · DSCP RFC 3168 · ECN RFC 6864 · ID 20–60 bytes checksum
layer internet header 20 B + 0–40 B options checksum header only byte order big-endian

01Header layout

click a field to pin it · esc clears

The first five 32-bit words are mandatory. IHL counts 32-bit words, so a value of 5 means a 20-byte header; each additional word carries options. The header checksum covers the header and options, but never the payload.

units, not bytes

IHL is in 32-bit words (multiply by 4 for bytes). Fragment Offset is in 8-byte units (multiply by 8 for a byte offset). Getting either wrong shifts every field after it by a factor of four or eight.

02Fragmentation flags

bits 48–63 of the header

Three flag bits and a 13-bit offset decide whether a packet is a complete datagram, the first fragment, a middle fragment, or the last one. Toggle them to see the raw 16-bit word and the byte range each offset addresses.

IPv4 flags + fragment offsetnetwork byte order
0x4000
flags DF offset 0 B range 0–1479 consistent

DF and MF together are contradictory. A non-zero offset with MF=0 is the final fragment; offset 0 with MF=1 is the first. The reserved bit must be zero (RFC 3514's “evil bit” is an April Fools' joke, not a deployment).

03Options & TLVs

0–40 bytes · padded to 4

IPv4 options are a type-length-value list. The type octet is split into a copied bit, a two-bit class, and a five-bit number. Every option except EOL and NOP carries a length that includes the type and length octets.

option type octet
8 bits
Ccopied
00class · 2
number · 50–31

Class 0 = control, 2 = debugging and measurement, 1 and 3 reserved. The copied bit tells routers whether to copy the option into each fragment.

option type factory

type octet
type octet
0x07 · RR

writing an option

TLV rules
type   length   data…
+------+--------+----------------+
| 0x94 |   4    | 00 00          |  Router Alert
+------+--------+----------------+
| 0x07 |   7    | 04 192.0.2.1   |  Record Route
+------+--------+----------------+
  • EOL (0x00) and NOP (0x01) are one byte; no length.
  • Pad the option list with EOL or NOP to a multiple of 4 bytes.
  • IHL = 5 + (option bytes ÷ 4); the maximum is 15 words / 40 bytes.
  • Source-routing options (LSRR/SSRR) are widely filtered or disabled.
TypeNameLength (B)ReferenceNotes
0x00EOL1RFC 791 §3.1End of option list; pad the rest.
0x01NOP1RFC 791 §3.1Alignment filler.
0x07RR · Record Route3–39RFC 791 §3.1Pointer + up to nine IPv4 addresses.
0x44TS · Timestamp4–40RFC 791 §3.1Overflow/flag nibble; 32-bit timestamps, optionally with addresses.
0x82Security11RFC 791 · RFC 1108Obsolete; basic security option.
0x83LSRR · Loose Source Route3–39RFC 791 §3.1Loose source route; often dropped.
0x88SID · Stream ID4RFC 791 §3.1Obsolete SATNET stream identifier.
0x89SSRR · Strict Source Route3–39RFC 791 §3.1Strict source route; often dropped.
0x94Router Alert4RFC 2113 · RFC 5350Value 0: router shall examine. Value 1: IGMP. Value 2: RSVP.
0x52Trace · Traceroute4RFC 1393Experimental; 16-bit ID number.
the parser must trust length, not hope

A zero length would loop forever; a length beyond the header is a truncation bug. Always verify that the option length is at least 2, fits inside the IHL-derived header, and that the pointer in RR/TS/LSRR/SSRR stays inside the option.

04Encoder

checksum computed automatically

Fill in the fields and build a valid header. Options are padded to a 4-byte boundary; the resulting hex is ready for a lab tool or a packet builder.

build an IPv4 header

20–60 B

The checksum is computed over the final header, including options. Reserved bits are kept visible so you can deliberately build malformed test traffic.

wire output

waiting
Set the fields and press Build header.
header hex
no bytes built yet
what the encoder will not do

It does not add a transport header, compute TCP/UDP checksums, or choose a path MTU. It only makes the IPv4 header self-consistent. Payload length is a promise encoded in Total Length; the actual payload is yours to append.

05Decoder

paste a header or a full IPv4 packet

Paste hex from Wireshark, tcpdump -XX, Scapy or a hex editor. Spaces, colons, dashes and 0x prefixes are ignored. An Ethernet II frame with ethertype 0x0800 is detected automatically; otherwise the first byte must be an IPv4 version nibble.

parse bytes

RFC 791 · header + options
No input decoded yet.

06Wire notes

gotchas from the field
checksum offload lies

Captures taken on the sending host often show an incorrect IPv4 checksum because the NIC computes it after the capture point. Validate checksums on traffic captured after the offload boundary before declaring a bug.

  • Total Length includes the header. A 20-byte header with 100 bytes of payload has Total Length = 120. Parsers must use it to find the payload, not the capture length.
  • IHL can be larger than the packet. If IHL × 4 exceeds the available bytes, the header is truncated; do not read options.
  • Fragment offsets count 8-byte units. Reassembly uses the offset, the MF flag and identification; the last fragment clears MF. Overlapping fragments are a classic evasion technique.
  • Options are part of the header. The checksum includes them; middleboxes that rewrite options must update it. Padding to 4 bytes is mandatory.
  • TTL is decremented on every router. A value of 0 at a router yields ICMP Time Exceeded; initial values are convention (64, 128, 255), not protocol constants.
  • Protocol 41 is IPv6-in-IPv4. It is not “IPv6 itself”; the inner header starts after the IPv4 header. See the IPv6 explorer. Protocol 6 and 17 are TCP and UDP.

References

next protocol ICMP errors & echo ->