IPv4 Header Structure

The header, field by field

A router doesn't care what's inside a packet's payload, HTTP (Hypertext Transfer Protocol) request or DNS (Domain Name System) query or anything else. It only reads the IPv4 header wrapped around that payload, and mostly just a handful of fields in it.

The IPv4 header. Everything below the first row is 32 bits wide, exactly like the header diagrams you'll see in any packet capture tool. The payload isn't part of the header itself, but it's what the header exists to wrap.

Every field, decoded

Field by field, in the order they appear in the diagram above:

Field	Size	What it holds
Version	4 bits	Always `4` for IPv4
IHL (Internet Header Length)	4 bits	Header length in 32-bit words; `5` (20 bytes) unless Options are present
DSCP (Differentiated Services Code Point)	6 bits	Traffic priority marking for QoS, e.g. `EF` (Expedited Forwarding) for voice
Total Length	16 bits	Whole packet's size in bytes, header plus payload, up to 65,535
Identification	16 bits	Shared across every fragment of the same original packet, so the destination knows which pieces belong together
Flags	3 bits	DF (Don't Fragment) and MF (More Fragments); see IPv4 Fragmentation
Fragment Offset	13 bits	Where this fragment's data starts within the original payload, in 8-byte units
TTL (Time to Live)	8 bits	Decremented at every hop; the packet is dropped once it hits 0
Protocol	8 bits	What's riding inside: `6` = TCP, `17` = UDP, `1` = ICMP
Header Checksum	16 bits	Integrity check on the header only, recalculated at every hop
Source Address	32 bits	Sender's IP address
Destination Address	32 bits	Receiver's IP address, what routers actually look up
Options	0–40 bytes	Rarely used in practice: timestamps, security markings, source routing
Payload	Variable	The actual application data the header exists to deliver: an HTTP request, a DNS query, anything

The fields that actually drive behavior

TTL (Time to Live): starts at some value (commonly 64 or 128) and is decremented by every router the packet passes through. Hit zero, and the packet is dropped, with an ICMP (Internet Control Message Protocol) Time Exceeded message sent back. This single field is the entire mechanism behind traceroute, covered in the next topic.
Protocol: tells the receiving host what's riding inside the payload: 6 means TCP (Transmission Control Protocol), 17 means UDP (User Datagram Protocol), 1 means ICMP is next.
Source / Destination IP (Internet Protocol) Address: what routing decisions are actually based on. The destination address gets looked up against the routing table at every hop.
Flags / Fragment Offset: handle splitting a packet that's too large for a link's MTU (Maximum Transmission Unit) into smaller fragments, and reassembling them at the far end.
Header Checksum: a simple integrity check on the header itself (not the payload), recalculated at every hop since TTL changes each time.

WHY THIS FIELD LIST MATTERS BEYOND TRIVIA

When you open a packet capture in Wireshark, this is exactly the breakdown you'll see for every IPv4 packet, field for field. Knowing what TTL and Protocol mean here is what makes a capture readable instead of just a wall of hex.