What does the protocol field in ipv4 header is 1 indicate

Overview of IPv4 Header Format

IPV4 header format is of  20 to 60 bytes in length, contains information essential to routing and delivery, consist of 13 fields, VER, HLEN, service type, total length, identification, flags, fragmentation offset, time to live, protocol, header checksum, source IP address, Destination IP address and option + padding, where each has its own features and provides essential data required to transmit the data.

An IPv4 packet header has a total of 14 fields; among these 14 fields, only one is optional, which is aptly known as the options component.

IPv4 Header Format Component

Below is the list mentioned.

1. Version.
2. Internet Header Length.
3. Type of Service.
4. Explicit Congestion Notification.
5. Total Length.
6. Identification.
7. Flags.
8. Fragment Offset
9. Time to live.
10. Protocol.
11. A checksum of header.
12. Source Address.
13. Destination Address.
14. Options.

Let’s take a look at these components, their sizes and what they can do:

• Version: The first header field is a 4-bit version indicator. In the case of IPv4, the value of its four bits is set to 0100, which indicates 4 in binary.
• Internet Header Length: IHL is the 2nd field of an IPv4 header, and it is of 4 bits in size. This header component is used to show how many 32-bit words are present in the header. As we know, IPv4 headers have a variable size, so this is used to specify the size of the header to avoid any errors. This size can be between 20 bytes to 60 bytes.
• Type of Service: ToS is also called Differentiated Services Code Point or DSCP. This field is used to provide features related to service quality, such as for data streaming or Voice over IP (VoIP) calls. It is used to specific how a datagram will be handled.
• Explicit Congestion Notification: ECN is used to send notifications to the sender or receive in situations where network congestion happens. This is an optional feature of IPv4 can; if one of the endpoints don’t support it, it is not used.
• Total Length: This field’s size is 16 bit, and it is used to denote the size of the entire datagram. The minimum size of an IP datagram is 20 bytes, and at the maximum, it can be 65,535 bytes. Practically, all hosts are required to be able to read 576-byte datagrams. If a datagram is too large for the hosts in the network, fragmentation is used, which is handled in the host or packet switch.
• Identification: The identification or ID field in a packet can identify an IP datagram’s fragments uniquely. Some have suggested using this field for other things such as adding information for packet tracing etc.
• Flags: flag in an IPv4 header is a three-bit field that is used to control and identify fragments. The following can be their possible configuration:
  • Bit 0: this is reserved and has to be set to zero
  • Bit 1: DF or do not fragment
  • Bit 2: MF or more fragments.
• Fragment Offset: This field is 13 bit long in length, and it is measured by blocks that units of 8-byte blocks. These are used to specify the offset of a fragment relative to the start of the IP datagram, which when it was not fragmented. As you can expect, the first offset of a fragment is always set to zero. The maximum possible offset is ( 213-1 ) * 8 = 65528, but it is more than the maximum possible IP Packet length, which is 65,535 bytes long with the length of a header added in.
• Time to live: Time to live (or TTL in short) is an 8-bit field to indicate the maximum time the datagram will be live in the internet system. The time here is measured in seconds, and in case the value of TTL is zero, the datagram is erased. Every time a datagram is processed, it’s Time to live is decreased by one second. These are used so that datagrams that are not delivered are discarded automatically. TTL can be between 0 – 255.
• Protocol: This is a filed in the IPv4 header reserved to denote which protocol is used in the later (data) portion of the datagram. For Example, number 6 is used to denote TCP and 17 is used to denote UDP protocol.
• The header’s checksum: The checksum field is of 16-bit length, and it is used to check the header for any errors. The header is compared to the value of its checksum at each hop, and in case the header checksum is not matching, the packet is discarded. Keep in mind that this is only for the header, and its protocol handles the data field. UDP and TCP, for example, have their own checksum fields.
• Source Address: It is a 32-bit address of the source of the IPv4 packet.
• Destination Address: the destination address is also 32 bit in size, and it contains the receiver’s address.
• Options: This is an optional field of the IPv4 header. It is used only when the value of IHL is set to more than 5. These options contain values and settings for things related to security. Record route and time stamp etc. You will find that the list of options component ends with an End of Options or EOL in many cases.

Conclusion

IP headers are one of the crucial components of the protocol. Being able to tell the network about the datagram, its source, and its destination is important, and so is the ability to detect any errors in the header to avoid using corrupted packets. Considering that almost all of the modern internet relies on IPv4 and IPv6, these headers are used in almost all of the HTTP internet traffic.

Recommended Articles

This has been a guide to IPv4 Header Format. Here we discussed Introduction to IPv4 Header Format, its components with their sizes and what they are used for. You can also go through our other suggested articles to learn more –

Header : IPv4

Version

This field (4 bits) indicates IP version. It is always 4 in IPv4 header.

DSCP (Differentiated Services Code Point)

This field (6 bits) used to be called  ToS('Type of Service') and now renamed to DSCP. Refer to rfc2475 for the details.

ECN(Explicit Congestion Notification)

This field (2 bits) is used for end to end notification of Network Congestion. It has following meaning

• 00 � Non ECN-Capable Transport, Non-ECT
• 10 � ECN Capable Transport, ECT(0)
• 01 � ECN Capable Transport, ECT(1)
• 11 � Congestion Encountered, CE.

Internet Header Length (IHL)

This field (4 bit) indicates the length of the IP header and the unit is 4 bytes (32 bits). So, if the value of this field is 5, it means the length of IP header is 20 bytes (= 5 x 4 bytes).

Total Length

This field (16 bits) indicates the total length of the IP packet (Length of IP header + Length of payload) in bytes. The minimum value is 20 bytes since the minimum IPv4 header length is 20 bytes.

The length of field is 16 bits. This means the max length of one IP packet is 2^16 Bytes (65535 bytes) including the header. the minimum length of one IP packet is 20 bytes which is the case in which there is only IP header and No payload.

Identification

This field (16 bits) is used to uniquely identify a group of fragments that belongs to the same IP diagram.

Flags

This field (3 bits) is used to control and indentify the fragments. The meaning of each bit is as follows.

• bit 0: Reserved; must be zero.
• bit 1: Don't Fragment (DF)
• bit 2: More Fragments (MF)

For unfragmented packets, the MF flag is set to be 0.

For fragmented packets, bit 0 set to be 0, bit 1 is set to be 0 and bit 2 is set to be 1 (However, in case of the last fragment of the fragmented packets all bits are set to be 0)

Fragment Offset

This field (13 bits) indicates the position of a fragemented packets from the biginning of the original packet. The unit is the multiples of 8 bytes. For example, if the value is 1, it menas the fragment offest is 8 bytes . if the value is 10, it means the fragment offset is 80 bytes. The value for unfragmented packet or the first fragment of the fragmented packet is set to be 0.

Time to Live

This field (8 bits) indicates how long the packet can survive in the network. Even though the unit is in seconds, it is practically interpreted as the number of hops it can go through. When the datagram arrives at a router, the router decrements the TTL field by one. When the TTL field hits zero, the router discards the packet and typically sends an ICMP Time Exceeded message to the sender. In this way, we can avoid the situation in which a packet goes round and round within the network without reaching the final destination.

Protocol

This field (8 bits) indicates the protocol of the payload part and can be specified by one of the following values.

Header Checksum

This field (16 bits) carries the checksum value of the header. It may be confusing.. because Header Checksum field is also a part of the header. So you may ask 'does checksum calculation includes HeadChecksum field or not ?'. The answer is 'Yes, the HeadChecksum field is also used in the checksum calculation, but the value is always assumed to be all zero.

Source Address / Destination Address

Both Source address and Destination Address takes 32 bits for each. These address are represted as follow format.

W.X.Y.Z

W, X, Y, Z can be any number between 0 and 255, but depending on various purpose/class these number can take a specific range of values as below. (You can figure out the IP set to your PC using ipconfig command (in windows) or ifconfig (in Linux) and you can figure out the ip for a specific site using nslookup).

Followings are IP addresses that are reserved for private networks.

Followings are some of the IP addresses that are reserved for special purpose.

Example 01 > ===========================================================

Internet Protocol Version 4, Src: 1.1.1.100 (1.1.1.100), Dst: 1.1.1.1 (1.1.1.1)

    Version: 4

    Header length: 20 bytes

    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))

        0000 00.. = Differentiated Services Codepoint: Default (0x00)

        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)

    Total Length: 32

    Identification: 0x0a76 (2678)

    Flags: 0x00

        0... .... = Reserved bit: Not set

        .0.. .... = Don't fragment: Not set

        ..0. .... = More fragments: Not set

    Fragment offset: 0

    Time to live: 128

    Protocol: Unknown (253)

    Header checksum: 0x2b05 [correct]

        [Good: True]

Following is the HEX string and Binary String for the IP header decoded above, try decode each field on your own and compare your decoding with the wireshark decode shown above. You can get the C language example of IPv4 decoding if you are interested.

HEX : 45 00 00 20 0a 76 00 00 80 fd 2b 05 01 01 01 64 01 01 01 01

BIN :

01000101 00000000 00000000 00100000

00001010 01110110 00000000 00000000

10000000 11111101 00101011 00000101

00000001 00000001 00000001 01100100

00000001 00000001 00000001 00000001