![]()
1. Version
- Identifies the IP version to which the packet belongs.
- 4 bit field is usually set to binary 0100. Version 4 (IPv4) is in current, common use.
2. Header Length
- is a four-bit field that tells the length of the IP header.
- The minimum length of the IP header is 20 octets, and the options may increase this size up to a maximum of 24 octets.
- This field describes the length of the header in terms of 32-bit words— five for the minimum
- 160-bit size and six for the maximum.
3. Type of Service (TOS)
- is an eight-bit field that can be used for specifying special handling of the packet.
- This field actually can be broken down into two subfields: Precedence and TOS.
- Precedence sets a priority for the packet, the way a package might be sent overnight, 2-day delivery, or general post.
- TOSallows the selection of a delivery service in terms of throughput, delay, reliability, and monetary cost.
![]()
4. Total Length
- is a 16-bit field specifying the total length of the packet, including the header, in octets.
- By subtracting the header length, a receiver may determine the size of the packet’s data payload.
- Because the largest decimal number that can be described with 16 bits is 65,535, the maximum possible size of an IP packet is 65,535 octets.
5. Identifier
- is a 16-bit field used in conjunction with the Flags and Fragment Offset fields for fragmentation of a packet.
- Packets must be fragmented into smaller packets if the original length exceeds the Maximum Transmission Unit (MTU) of a data link through which they pass.
- For example, consider a 5,000-byte packet traveling through an internetwork.
- It encounters a data link whose MTU is 1,500 bytes— that is, the frame can contain a maximum packet size of 1,500 bytes.
- The router that places the packet onto this data link must first fragment the packet into chunks of no more than 1,500 octets each.
- The router then marks each fragment with the same number in the Identifier field so that a receiving device can identify the fragments that go together.
Note : The DF bit can be used in troubleshooting to determine a path’s MTU.
6. Flags
- is a three-bit field in which the first bit is unused.
- The second is the Don’t Fragment (DF) bit.
- When the DF bit is set to one, a router cannot fragment the packet.
- If the packet cannot be forwarded without fragmenting, the router drops the packet and sends an error message to the source.
- This function enables the testing of MTUs in an internetwork.
- The DF bit can be set using the Extended Ping utility on Cisco routers.
- The third bit is the More Fragments (MF) bit.
- When a router fragments a packet, it sets the MF bit to one in all but the last fragment so that the receiver knows to keep expecting fragments until it encounters a fragment with MF = 0.
***********************************************************************
Extra Tips: The Cisco Extended Ping utility allows the setting of the DF bit to test MTUs across an internetwork. Below, the largest MTU of the path to destination 119.42.222.215 is 1,478 octets.
MPLS-ROUTER #ping
Protocol [ip]:
Target IP address: 119.42.222.215 <<<< Destination Router
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface:
Type of service [0]:
Set DF bit in IP header? [no]: y <<< set to Yes
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]: r
Number of hops [ 9 ]:
Loose, Strict, Record, Timestamp, Verbose[RV]:
Sweep range of sizes [n]: y
Sweep min size [76]: 500 <<< Minimum packet size
Sweep max size [18024]: 2000 <<< Maximum packet size
Sweep interval [1]: 500
Type escape sequence to abort.
Sending 20, [500..2000]-byte ICMP Echos to 119.42.222.215, timeout is 2 seconds:
Packet sent with the DF bit set
Packet has IP options: Total option bytes= 39, padded length=40
Record route:
(0.0.0.0)
(0.0.0.0)
(0.0.0.0)
(0.0.0.0)
(0.0.0.0)
(0.0.0.0)
(0.0.0.0)
(0.0.0.0)
(0.0.0.0)
Reply to request 0 (112 ms) (size 500). Received packet has options
Total option bytes= 40, padded length=40
Record route:
(119.42.217.134)
(202.163.59.82)
(119.42.217.145)
(119.42.222.215)
(119.42.217.146)
(202.163.59.71)
(119.42.217.134)
(0.0.0.0)
(0.0.0.0)
End of list
Reply to request 1 (112 ms) (size 1000). Received packet has options
Total option bytes= 40, padded length=40
Record route:
(119.42.217.134)
(202.163.59.82)
(119.42.217.145)
(119.42.222.215)
(119.42.217.146)
(202.163.59.71)
(119.42.217.134)
(0.0.0.0)
(0.0.0.0)
End of list
Reply to request 2 (116 ms) (size 1500). Received packet has options
Total option bytes= 40, padded length=40
Record route:
(119.42.217.134)
(202.163.59.82)
(119.42.217.145)
(119.42.222.215)
(119.42.217.146)
(202.163.59.71)
(119.42.217.134)
(0.0.0.0)
(0.0.0.0)
End of list
As observed, there were request timeout for packet size at 2000 bytes and replied back at packet size of 500 bytes as this was the initial interval sweep size.
Request 3 timed out (size 2000)
Reply to request 4 (112 ms) (size 500). Received packet has options
Total option bytes= 40, padded length=40
Record route:
(119.42.217.134)
(202.163.59.82)
(119.42.217.145)
(119.42.222.215)
(119.42.217.146)
(202.163.59.71)
(119.42.217.134)
(0.0.0.0)
(0.0.0.0)
End of list
************************************************************************
7. Fragment Offset
- is a 13-bit field that specifies the offset, in units of eight octets, from the beginning of the header to the beginning of the fragment.
- Because fragments may not always arrive in sequence, the Fragment Offset field allows the pieces to be reassembled in the correct order.
- If a single fragment is lost during a transmission, the entire packet must be resent and refragmented at the same point in the internetwork.
8. Time to Live (TTL)
- is an eight-bit field that will be set with a certain number when the packet is first generated.
- As the packet is passed from router to router, each router will decrement this number.
- If the number reaches zero, the packet will be discarded and an error message will be sent to the source.
- This process prevents “lost” packets from wandering endlessly through an internetwork.
- The TTL was specified in seconds; if a packet was delayed more than a second in a router, the router would adjust the TTL accordingly.
- However, this approach is difficult to implement and is rarely supported.– Most routers simply decrement the TTL by one, no matter what the actual delay, so the TTL is really a hop count.
- The recommended default TTL is
- 64, although values such as 15 and 32 are not uncommon.
****************************************************************************
Extra Tips: Cisco’s trace command
- make use of the TTL field.
- If the router is told to trace the route to a host address such as 10.11.12.13, the router will send three packets with the TTL set to one; the first router will decrement it to zero, drop the packets, and send back error messages to the source.
- By reading the source address of the error messages, the first router on the path is now known.
- The next three packets will be sent with a TTL of two.
- The first router decrements to one, the second to zero, and an error message is received from the second router.
- The third set has a TTL of three, and so forth, until the destination is found. All routers along the internetwork path will have identified themselves.
*********************************************************************************
9. Protocol
- is an eight-bit field that gives the “address,” or protocol number, of the host-to-host or transport layer protocol for which the information in the packet is destined.
10. Header Checksum (RFC 1141)
- is the error correction field for the IP -header.
- The checksum is not calculated for the encapsulated data; UDP, TCP, and ICMP have their own checksums for doing this.
- The field contains a 16-bit one’s complement checksum, calculated by the originator of the packet.
- The receiver will again calculate a 16-bit one’s complement sum, including the original checksum.
- If no errors have occurred during the packet’s travels, the resulting checksum will be all ones.
- Remember that each router decrements the TTL; therefore, the checksum must be recalculated at each router.
11. Source and Destination Addresses
- are the 32-bit IP addresses of the originator of the packet and the destination of the packet.
12. Options
- is a variable-length field and, as the name implies, is optional. – Space is added to the packet header to contain either source-generated information or for other routers to enter information; the options are used primarily for testing.
The most frequently used options follow.
Loose source routing
o in which a series of IP addresses for router interfaces is listed.
o The packetmust pass through each of these addresses, although multiple hops may be taken between the addresses.
Strict source routing,
o where again a series of router addresses is listed. Unlike loose source routing, the packet must follow the route exactly. If the next hop is not the next address on the list, an error occurs.
Record route
o provides room for each router to enter the address of its outgoing interface as the packet transits so that a record is kept of all routers the packet encounters. Record route provides a function similar to trace except that the outgoing interfaces both on the path to the destination and on the return path are recorded.
Timestamp
o is an option similar to record route except each router also enters a timestamp— the packet not only keeps track of where it has been but also records when it was there.
13. Padding
- ensures that the header ends on a 32-bit boundary by adding zeros after the option field until a multiple of 32 is reached
*******************************************************************************
Extra Tips: The Cisco Extended Ping may be used to set parameters in the Options field of the IP header. In
this example, loose source routing and timestamp are used.
MPLS-ROUTER #ping
Protocol [ip]:
Target IP address: 119.42.222.215
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface:
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]: 1
% No such option – “1”Loose, Strict, Record, Timestamp, Verbose[none]: l
Source route: 172.17.224.2
Loose, Strict, Record, Timestamp, Verbose[LV]: t
Number of timestamps [ 7 ]: 2
Loose, Strict, Record, Timestamp, Verbose[LTV]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 119.42.222.215, timeout is 2 seconds:
Packet has IP options: Total option bytes= 19, padded length=20
Loose source route:
(172.17.224.2)
Timestamp: Type 0. Overflows: 0 length 12, ptr 5
>>Current pointer<<
Time= 08:00:00.000 SPORE (00000000)
Time= 08:00:00.000 SPORE (00000000)
Unreachable from 119.42.217.133. Received packet has options
Total option bytes= 19, padded length=20
Loose source route:
(172.17.224.2)
Timestamp: Type 0. Overflows: 0 length 12, ptr 5
>>Current pointer<<
Time= 08:00:00.000 SPORE (00000000)
Time= 08:00:00.000 SPORE (00000000)
Unreachable from 119.42.217.133. Received packet has options
Total option bytes= 19, padded length=20
Loose source route:
(172.17.224.2)
Timestamp: Type 0. Overflows: 0 length 12, ptr 5
>>Current pointer<<
Time= 08:00:00.000 SPORE (00000000)
Time= 08:00:00.000 SPORE (00000000)
Unreachable from 119.42.217.133. Received packet has options
Total option bytes= 19, padded length=20
Loose source route:
(172.17.224.2)
Timestamp: Type 0. Overflows: 0 length 12, ptr 5
>>Current pointer<<
Time= 08:00:00.000 SPORE (00000000)
Time= 08:00:00.000 SPORE (00000000)
Unreachable from 119.42.217.133. Received packet has options
Total option bytes= 19, padded length=20
Loose source route:
(172.17.224.2)
Timestamp: Type 0. Overflows: 0 length 12, ptr 5
>>Current pointer<<
Time= 08:00:00.000 SPORE (00000000)
Time= 08:00:00.000 SPORE (00000000)
Unreachable from 119.42.217.133. Received packet has options
Total option bytes= 19, padded length=20
Loose source route:
(172.17.224.2)
Timestamp: Type 0. Overflows: 0 length 12, ptr 5
>>Current pointer<<
Time= 08:00:00.000 SPORE (00000000)
Time= 08:00:00.000 SPORE (00000000)
Success rate is 0 percent (0/5)
Disclaimer: The materials used for this post is for personal notes on my preparations for the CCIE certifications. Source of notes were taken from Routing TCP/IP Volume 1.
Leave a comment