PROTOCOLS-FUN . PACKET ANATOMY

IPv4 Anatomy

RFC 791 (1981)
rev 2026.08

header 20 bytes (up to 60 with options)

checksum header only, per-hop

addresses 32-bit

RFC 791 (1981) - the datagram format nearly everything rides on: a 20-byte header (up to 60 with options) in front of every packet the internet routes. Three fields are sub-byte - Version and IHL share the first byte, and the fragmentation Flags/Offset split a 16-bit word - so IPv4 reads best bit by bit. Its header checksum covers the header only and is recomputed at every hop (the TTL changes each time); IPv6 dropped the header checksum entirely and moved options into an extension-header chain. Hover a field to light its bits, click a field marked + for its lookup table.

header20 bytes, IHL=5specRFC 791exampleTCP, DF set

A real minimal (no-options) IPv4 header for a TCP segment from 192.0.2.1 to 198.51.100.10 (RFC 5737 documentation addresses). Shown bit-by-bit because Version/IHL and the fragmentation word don't fall on byte boundaries.

IPv4 header - 20 bytes / 160 bits

The header checksum below is real: re-summing all ten 16-bit words with this value included folds to zero (verified).

fieldbyte 1 (was ToS)DSCP6 bits, RFC 2474ECN2 bits, RFC 3168

The second byte was originally "Type of Service"; RFC 2474/3168 redefined it as 6 bits of Differentiated Services Code Point (which QoS class) plus 2 bits of Explicit Congestion Notification. Shown here set to EF (Expedited Forwarding) - the class voice traffic uses.

Differentiated Services byte (8 bits)

fieldsbytes 4-7offset unit8 bytesexampleMF set, mid-datagram

Identification, Flags, and Fragment Offset are how a datagram too big for a link's MTU gets split and reassembled. This is the middle fragment of a datagram: same Identification as its siblings, MF (more fragments) set, and an offset placing its payload at byte 1480 of the original.

Identification + Flags + Fragment Offset (32 bits)

Fragmentation is largely deprecated in practice. The Fragment Offset counts in 8-byte units (13 bits x 8 = 65528-byte reach), which is why every fragment except the last must be a multiple of 8 bytes. On-path fragmentation is now avoided in favor of Path MTU Discovery (the router sends ICMPv4 Destination Unreachable, code 4 instead), and IPv6 removed router fragmentation entirely.

triggerIHL > 5exampleRouter Alert, RFC 2113size24-byte header

When IHL is greater than 5, one or more 32-bit option words follow the base header. This one carries a single Router Alert option (RFC 2113): "every router on the path must inspect this packet, not just forward it" - used by protocols like RSVP and IGMP. Shown byte-by-byte since options are byte-structured.

IPv4 header with Router Alert option - 24 bytes

IHL is now 6 (byte 0 = 0x46) and the checksum is recomputed over the larger header - verified to fold to zero.