Analyser IPv4 packet headers
IPv4 headers contain source/destination IPs, TTL, protocol, et fragmentation info. Apprendre en décoder IP headers pour packet analyse.
- 1
An IPv4 header is 20-60 bytes. Fields: version + IHL (1 byte), DSCP + ECN (1), total length (2), identification (2), flags + fragment offset (2), TTL (1), protocol (1), checksum (2), source IP (4), dest IP (4), options (0-40). Protocol: 6=TCP, 17=UDP, 1=ICMP, 89=OSPF.
- 2 Décodeur hexadécimal →
Décoder the hex representation of an IPv4 header. The first nibble is version (4), second is IHL (header length in 32-bit words, usually 5 = 20 bytes). Bytes 8-9 are TTL and protocol. Bytes 12-15 are source IP, 16-19 are destination IP.
- 3 Informations d'adresse IP →
Look up the source and destination IP addresses to understand the network context. Determine if they are private/public, what network they belong to, and whether the packet is being routed or switched.
Questions fréquentes
- What is TTL and why does it matter?
- Time To Live is decremented by each router. When it reaches 0, the packet is dropped (and an ICMP Time Exceeded is sent). This prevents packets from circulating forever in routing loops. Typical values: 64 (Linux), 128 (Windows), 255 (Cisco). Traceroute uses incrementing TTL to discover the path.
- How does IP fragmentation work?
- If a packet exceeds the MTU (usually 1500 bytes), the router fragments it. Each fragment has the same identification field but different fragment offsets. The MF (More Fragments) flag is set on all but the last. The destination reassembles. Avoid fragmentation with PMTUD or set the DF (Don't Fragment) flag.