IPv4 Addressing and Header

• Layering, OSI and TCP/IP Reference Models: the network layer and encapsulation.
• Number Systems: binary, hexadecimal and dotted-decimal conversion.

Addresses

Special addresses

The header

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-------+-------+---------------+-------------------------------+
|Version|  IHL  |Type of Service|          Total Length         |
+-------+-------+---------------+-----+-------------------------+
|         Identification        |Flags|     Fragment Offset     |
+---------------+---------------+-----+-------------------------+
|  Time to Live |    Protocol   |        Header Checksum        |
+---------------+---------------+-------------------------------+
|                         Source Address                        |
+---------------------------------------------------------------+
|                      Destination Address                      |
+---------------------------------------------------------------+
|                    Options (if IHL > 5)                       |
+---------------------------------------------------------------+

• Header length $= 4 \times \text{IHL}$ bytes. IHL 5 means 20 bytes; IHL 15 gives the 60-byte maximum, with 40 bytes of options.
• Data length $= \text{total length} - 4 \times \text{IHL}$.
• Largest datagram 65,535 bytes, so at most $65{,}535 - 20 = 65{,}515$ data bytes.
• Fragment offset $\times 8$ gives the byte position, so all fragments except the last carry a multiple of 8 data bytes; the largest expressible offset is $(2^{13} - 1) \times 8 = 65{,}528$.
• Checksum. The 16-bit one's complement of the one's complement sum of the header's 16-bit words, computed with the checksum field set to 0 (Error Detection: Parity and Checksum). Since TTL changes at every router, every router recomputes it. For a changed header word $m\to m\prime$, RFC 1624 gives $HC\prime=\mathord{\sim}(\mathord{\sim}HC+\mathord{\sim}m+m\prime)$, with one's-complement sums. TTL is the high byte of its word: for a TTL-only decrement, add 0x0100 with end-around carry, then normalize a resulting 0xFFFF to 0x0000 (the zero-boundary exception).

Example 1: decoding a header

45 00 05 dc 1c 46 40 00 40 06 83 f0 c0 a8 0a 05 ac 10 1e 28

Example 2: options

Example 3: classes and host counts

Related material. ARP and DHCP message counts

• ARP maps an IP address on the local network to a MAC address: one broadcast ARP request ("who has 192.168.10.1?") and one unicast reply from the owner, 2 messages; the result is cached, so later datagrams need none. A host sending to a remote address ARPs for the default router's address, not the remote host's.
• DHCP gives a host its address: Discover (client broadcast), Offer (server), Request (client broadcast), Acknowledge (server), 4 messages over UDP, server port 67 and client port 68. The client uses source 0.0.0.0 until it has an address.

Related material. ICMP and the TTL

• Best effort. IP may lose, reorder or duplicate datagrams; reliability, if needed, is TCP's job.
• The checksum covers only the header. Transport protocols protect their own data.
• Hop by hop. Source and destination addresses stay the same along the path (except through NAT); the link-layer addresses change at every hop.
• IHL and fragment offset are scaled; total length is not. Mixing these units gives wrong lengths and offsets.

• "IHL counts bytes." It counts 4-byte words.
• "Total length is the data length." It includes the header.
• "The IP checksum covers the data." Header only.
• "A host has one IP address." Each interface has one; routers have several.
• "Class A has 128 usable networks." 126; networks 0 and 127 are reserved.

• Header decoding. Split hex into fields, apply the units (IHL $\times 4$, offset $\times 8$), and read the flags bit by bit.
• Class from first byte. 0 to 127 A, 128 to 191 B, 192 to 223 C, 224 to 239 D, 240 to 255 E.
• Host counts. $2^h - 2$ usable addresses for conventional broadcast subnets with $h\ge2$ host bits. /31 point-to-point links use both addresses as endpoints (RFC 3021); /32 denotes one address/host route.
• Special addresses. Network, directed broadcast, limited broadcast, loopback, private blocks.
• Checksum per hop. It changes because TTL changes.

• Layering, OSI and TCP/IP Reference Models: prerequisite. Where IP sits.
• Number Systems: prerequisite. Binary and hexadecimal.
• Distance-Vector Routing: how forwarding tables are filled by neighbour exchange.
• Link-State Routing: how forwarding tables are filled from the whole topology.
• IPv4 Fragmentation: the identification, flags and offset fields in use.
• CIDR Notation and Subnetting: prefix lengths replace classes.
• Network Address Translation (NAT): rewriting addresses at the edge of a private network.