The "Envelope" of the Internet: What is a Packet and Header?

Imagine sending a letter through the postal service. The letter itself contains your message, but it can't go anywhere on its own. You place it inside an envelope, on which you write crucial information: the recipient's address, your return address, and perhaps a stamp indicating the service priority.

In the digital world, data travels in much the same way. The information you send (whether it's part of a webpage, an email, or a video stream) is called the payload (the letter). This payload is placed inside a digital container called a packet. The IPv4 header is the digital "envelope" for this packet. It's a block of metadata that contains all the essential instructions for routers and computers to deliver the packet across the internet to its correct destination.

Overall Structure of the IPv4 Header

The IPv4 header has a well-defined and standardized structure. Its standard size is 20 bytes (160 bits), though it can be larger if optional fields are used. The header is organized into multiple rows of 32 bits (4 bytes) each, which helps in efficient processing by network hardware.

Let's break down each field in the order it appears, understanding its purpose and significance in the journey of a packet. The first 20 bytes (5 rows) are mandatory in every IPv4 packet.

Fields 1-4: The Packet's Core Identity

1. Version (Ver) - 4 bits

This very first field identifies the version of the Internet Protocol being used. For every IPv4 packet, this field always has the binary value of 0100, which is the number 4 in decimal. This allows network devices to immediately distinguish an IPv4 packet from an IPv6 packet (which would have a value of 6, or 0110). It's the packet's way of saying, "Hello, I am an IPv4 packet."

2. Internet Header Length (IHL) - 4 bits

This field specifies the total length of the header itself. It's crucial because the header can have a variable size due to the optional "Options" field. However, this value is not measured in bytes. It is a 4-bit number that represents the number of 32-bit words (4-byte blocks) in the header.

• Minimum Value: 0101 (decimal 5). This corresponds to a header length of $5 \times 4 = 20$ bytes, the minimum possible size for a valid IPv4 header (without options).
• Maximum Value: 1111 (decimal 15). This corresponds to a header length of $15 \times 4 = 60$ bytes.

A router uses this IHL value to know exactly where the header ends and the actual data payload begins.

3. Type of Service (ToS) / Differentiated Services Code Point (DSCP) - 8 bits

This field is used to specify how a packet should be handled in terms of priority and Quality of Service (QoS). It tells routers whether a packet is part of a time-sensitive application (like a video call) or a less urgent one (like an email).

• Historically (ToS): The field was divided into sub-fields for "precedence," "delay," "throughput," and "reliability."
• Modern Use (DSCP): Today, the first 6 bits are typically used as a Differentiated Services Code Point (DSCP) value, allowing for more granular traffic classification and prioritization. For example, a router could be configured to give packets with a specific DSCP value (like those for Voice over IP) priority over others during times of network congestion.

4. Total Packet Length - 16 bits

This 16-bit field specifies the total length of the entire IP packet (header + data payload) in bytes.

• Minimum Size: 20 bytes (for a packet with a 20-byte header and no data).
• Maximum Size: The maximum value of a 16-bit number is $2^{16} - 1 = 65,535$. Therefore, the maximum size of an IPv4 packet is 65,535 bytes.

However, most networks have a much smaller Maximum Transmission Unit (MTU), such as 1500 bytes for Ethernet. This field is critical for the destination host to know how much data it should expect to receive for this packet, especially if the packet was fragmented.

Fields 5-7: Handling Fragmentation

When a packet is larger than the MTU of a network it needs to traverse, it must be broken down into smaller pieces. This process is called fragmentation. The following three fields work together to manage this process.Note: The detailed mechanics of fragmentation are a separate topic, but these fields provide the necessary control information.

5. Identification (ID) - 16 bits

If a packet is split into multiple fragments, each fragment is sent as its own separate packet. This Identification field contains a unique number that is the same for all fragments belonging to the original, single packet. When the fragments arrive at the destination, the receiving host uses this common ID to know which pieces belong together, allowing it to reassemble the original packet.

6. Flags - 3 bits

These three one-bit flags control the fragmentation process:

• Bit 0: Reserved and must always be set to 0.
• Bit 1: Don't Fragment (DF): If this bit is set to 1, it forbids routers from fragmenting the packet. If the packet is too large for a network's MTU and the DF flag is set, the router must drop the packet and send an error message back to the source. It's like putting a "Do Not Bend" sticker on a large photo being mailed.
• Bit 2: More Fragments (MF): This flag acts as a signal for reassembly. If MF is set to 1, it means this is a fragment of a larger packet, and more fragments are yet to come. If it is set to 0, it indicates that this is either the last fragment of a series, or the packet was never fragmented in the first place.

7. Fragment Offset - 13 bits

When a packet is fragmented, the data is split into chunks. The Fragment Offset field tells the receiving host exactly where in the original packet's payload this particular fragment's data belongs. It is measured in units of 8-byte blocks. For example, if a fragment has an offset of 100, its data starts at byte $100 \times 8 = 800$ in the original, unfragmented payload. This allows the destination host to reassemble the fragments in the correct order, even if they arrive out of sequence.

Fields 8-9: Packet Lifetime and Payload Type

8. Time To Live (TTL) - 8 bits

This is one of the most critical fields for maintaining the health of the internet. TTL is essentially a countdown timer that prevents packets from looping endlessly through the network in case of a routing error.

• The sending host sets an initial TTL value (e.g., 64 or 128).
• Every router that processes the packet must decrease the TTL value by at least one.
• If a router receives a packet and, after decrementing, the TTL value becomes zero, the router discards the packet and sends an error message (ICMP "Time Exceeded") back to the source.

Without TTL, a single routing loop could consume network bandwidth indefinitely, causing a network-wide traffic jam.

9. Protocol - 8 bits

The IP's job is to deliver the packet from a source host to a destination host. Once the packet arrives, the destination host's operating system needs to know which program or service should receive the data payload. The Protocol field specifies this. It contains a number that identifies the transport layer protocol to which the data should be passed.

• A value of 6 indicates that the payload is a TCP segment.
• A value of 17 indicates a UDP datagram.
• A value of 1 indicates an ICMP message, used for control and error reporting.

Fields 10-12: Integrity and Core Addressing

10. Header Checksum - 16 bits

This field provides a basic form of error detection for the IP header. The sending host calculates a checksum based on the values in all header fields and places the result here. Each router along the path verifies the checksum.

• If a router finds a mismatch, it indicates that the header was corrupted during transmission, and the packet is discarded.
• Because the TTL field changes at every router, the checksum must be recalculated by every router.
• Important: The checksum only covers the header. It does not protect the data payload, which is the responsibility of higher-level protocols like TCP or UDP.

11. Source Address - 32 bits

This is the 32-bit IPv4 address of the host that originally sent the packet.

12. Destination Address - 32 bits

This is the 32-bit IPv4 address of the intended recipient. This field is the primary piece of information that routers use to make their forwarding decisions, guiding the packet hop-by-hop across the internet.

Final Fields: Options and the Actual Data

13. Options (if any) - Variable Length (0 to 40 bytes)

This is an optional, variable-length field that can be used for special handling, testing, or debugging purposes. Examples include options to record the route a packet takes or to add timestamps. In the modern internet, the Options field is rarely used because processing it requires extra work from routers, which can slow down performance. If options are present, the IHL field will have a value greater than 5.

14. Data (Payload) - Variable Length

Following the header (and any options) is the actual data the packet is carrying. This is the payload, the "letter" inside the "envelope". Its content is passed down from a higher-level protocol (like TCP or UDP) and is not interpreted by the IP layer. The length of this payload can be calculated by subtracting the header length (IHL * 4) from the Total Packet Length.