Analysis of TCP/IP Headers

(1) IPv4 Header

The first field of the version IP packet header is the 4-bit version field. For IPv4, the value of this field is 4.
The second field of the header length (IHL) is the four-character header length, indicating the length of the 32-character header. Because the IPv4 header may contain an indefinite number of options, this field is also used to determine the data offset. The minimum value of this field is 5 (RFC 791), and the maximum value is 15.
The service type (TOS) is used to provide special services during the forwarding process.

The 16-bit field defines the total length of the message, including the header and data, in bytes. The minimum value of this field is 20 (20-byte header + 0-byte data) and the maximum value is 65,535. All Hosts must support a packet of at least 576 bytes, but most modern hosts support larger packets. Sometimes the subnet limits the packet size, and the packet must be split.
The Identifier Field is used to uniquely identify all parts of a message. For some experimental work, it is recommended that this field be used for other purposes, such as adding message tracing information to assist in detecting forged source addresses. [5]

The three-digit field is used to control and recognize the parts. They are:
Bit 0: reserved, must be 0;
Bit 1: fragment prohibited (DF );
Bit 2: More partitions (MF ).
If the DF flag is set but the route must be fragmented, the packet will be discarded. This flag can be used to send to a host without the ability to assemble parts.
When a packet is split, the MF flag is set for all parts except the last one. For messages that are not partitioned, do not set the MF flag: it is the last one of its own.

The 13-bit field indicates the offset of each part starting with the original message, in 8 bytes.
The TTL field prevents messages from always appearing on the Internet (for example, routing loops ). The survival time is measured in seconds, but the time smaller than one second is rounded up to one second. In reality, this is actually a number-of-hops counter: Each router passing through the packet will subtract this field by one. When this field is equal to 0, the packet will not be transmitted in the next hop and discarded. Generally, an ICMP packet is sent back to the sender, indicating that the packet sent has been discarded. This is also the core principle of traceroute.

The protocol field defines the protocol used in the message data area. IANA maintains a protocol list (originally defined by RFC 790 ).
The header test and the 16-bit test field are used to check the header for errors. In each hop, the calculated header test must be compared with this field. If they are inconsistent, the packet is discarded.
An IPv4 address of the source address consists of a total of 32 characters in four bytes. The value of this field is the 32-bit value obtained by converting each byte into a binary string and splicing them together.
The destination address is in the same format as the source address, but indicates the receiver of the message.
The header field appended to the option may be followed by the destination address, but this is not frequently used.
(2) IPv6 Header

(3) UDP header (4) TCP Header