Understanding the IPv4 Layer 3 Header: Structure and Key Fields
The IPv4 header is the routing instruction manual for internet communication, containing essential metadata that enables routers to forward packets across networks. Operating at the Network Layer (OSI Layer 3), this header ensures data reaches its destination while preventing issues like routing loops. This guide breaks down the structure, purpose, and key fields of the IPv4 header for both beginners and professionals.
Key Points
- The IPv4 header provides routing and control information for packet delivery across networks
- Version field (4 bits) distinguishes IPv4 (
4) from IPv6 (6) - DSCP enables traffic prioritization for Quality of Service (QoS)
- TTL is a hop counter (not a timer) that prevents infinite routing loops
- Protocol field identifies the Layer 4 protocol (TCP, UDP, ICMP, etc.)
- Source and Destination IP addresses remain unchanged end-to-end, except in NAT scenarios
- Routers examine only Layer 3 headers for forwarding decisions
Purpose of the IPv4 Header
The IPv4 header serves three critical functions:
- Addressing: Identifies source and destination using 32-bit IP addresses
- Control mechanisms: Manages packet lifetime (TTL), protocol identification, and traffic prioritization
- Error prevention: Prevents network congestion through TTL expiration and header checksums
Without the IPv4 header, routers would be unable to determine where to forward packets or how to handle them appropriately.
Essential Header Fields
| Field | Size (bits) | Purpose | Example Values |
|---|---|---|---|
| Version | 4 | Identifies IP version | 4 (IPv4) |
| IHL | 4 | Header length in 32-bit words | 5 (20 bytes minimum) |
| DSCP | 6 | Traffic prioritization | 46 (Expedited Forwarding) |
| Total Length | 16 | Entire packet size (header + data) | 1500 bytes |
| TTL | 8 | Hop counter to prevent loops | 64 (typical initial value) |
| Protocol | 8 | Layer 4 protocol identifier | 6 (TCP), 17 (UDP) |
| Source IP | 32 | Sender's IP address | 192.168.1.10 |
| Destination IP | 32 | Receiver's IP address | 8.8.8.8 |
Critical Fields Explained
Version Field
The Version field determines how routers interpret the entire packet structure.
- Size: 4 bits
- IPv4 value:
4 - Why it matters: A router receiving
Version=6will parse the packet as IPv6, using a completely different header structure
DSCP (Differentiated Services Code Point)
DSCP enables Quality of Service (QoS) by prioritizing certain traffic types over others.
- Size: 6 bits
- Use case: Ensures low-latency traffic (VoIP, video conferencing) gets priority over bulk transfers (file downloads)
- Common values:
0- Best effort (default)46- Expedited Forwarding (low latency)34- Assured Forwarding (guaranteed bandwidth)
Important: DSCP is optional and not all networks enforce it, but it's widely supported in enterprise environments.
TTL (Time To Live)
TTL is a hop counter that prevents packets from circulating indefinitely in routing loops.
How it works:
- Sender sets initial TTL value (commonly
64,128, or255) - Each router decrements TTL by
1before forwarding - When TTL reaches
0, the packet is discarded - Router sends an ICMP "Time Exceeded" message back to the source
Common misconception: TTL is NOT a time-based value—it counts router hops, not seconds.
Practical example:
Packet sent: TTL = 64
Router A: TTL = 63
Router B: TTL = 62
Router C: TTL = 61
...continues until destination or TTL = 0
Protocol Field
The Protocol field identifies which Layer 4 protocol is encapsulated in the packet.
| Value | Protocol | Common Use Cases |
|---|---|---|
1 | ICMP | Ping, traceroute, error messages |
6 | TCP | Web browsing (HTTP/HTTPS), email, file transfers |
17 | UDP | DNS queries, video streaming, VoIP |
41 | IPv6 | IPv6 tunneling over IPv4 |
89 | OSPF | Routing protocol communication |
Router behavior: Routers typically ignore this field—it's used by the destination host to determine how to process the payload.
Source and Destination IP Addresses
These 32-bit fields identify the sender and receiver of the packet.
Key characteristics:
- Destination IP is used by routers for forwarding decisions
- Source IP is used by the destination to send replies
- Both addresses remain unchanged during transit (except in NAT/proxy scenarios)
- Routers examine only the destination IP when consulting routing tables
NAT exception: In Network Address Translation, the source IP is modified as packets traverse the NAT gateway.
IPv4 Header Structure Diagram
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version| IHL | DSCP |ECN| Total Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Identification |Flags| Fragment Offset |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Time to Live | Protocol | Header Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source IP Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Destination IP Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Options (if IHL > 5) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Data |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Minimum header size: 20 bytes (when no options are present)
Common Pitfalls and Misconceptions
TTL is Not Time-Based
Misconception: TTL measures time in seconds.
Reality: TTL is a hop counter that decrements at each router, regardless of how long the packet waits in queues.
Routers Don't Examine Layer 4 Information
Misconception: Routers use port numbers for forwarding decisions.
Reality: Standard routers only examine Layer 3 headers (IP addresses, TTL). Port numbers are Layer 4 information used only by endpoints or Layer 4-aware devices (firewalls, load balancers).
DSCP Doesn't Guarantee Priority
Misconception: Setting DSCP automatically prioritizes traffic everywhere.
Reality: DSCP markings are only honored if network devices are configured for QoS. Many ISPs strip