Master IPv4:คู่มือนักพัฒนาเกี่ยวกับพื้นฐานโปรโตคอลและการจัดการแพ็กเก็ต

ในส่วนถัดไป คุณจะได้เรียนรู้เกี่ยวกับโครงสร้างของส่วนหัว IPv4

เมื่อคุณเข้าใจที่อยู่ IP ซับเน็ต และที่อยู่พิเศษแล้ว ก็ถึงเวลาตรวจสอบโครงสร้างส่วนหัว IPv4 โดยละเอียด

แผนภาพด้านบนแสดงส่วนหัวของ IPv4 ตามที่กำหนดใน RFC 791 มาตรวจสอบแต่ละฟิลด์กัน:

เวอร์ชัน (4 บิต)

ส่วนหัวเริ่มต้นด้วยฟิลด์เวอร์ชันซึ่งประกอบด้วยสี่บิต สำหรับแพ็กเก็ต IPv4 เวอร์ชันคือ 1756 ดังนั้นฟิลด์นี้จะมีค่า 1768 เสมอ (หรือ 1770 ในรูปแบบไบนารี)

❓ ทำไมส่วนหัวถึงขึ้นต้นด้วยช่อง Version? 🤔

(หมายเหตุ – เมื่อฉันขึ้นต้นประโยคด้วยเครื่องหมาย ❓มันเป็นคำถามที่ส่งถึงคุณ และฉันขอแนะนำให้คุณลองตอบก่อนอ่านต่อ)

เหตุผลก็คือช่องที่เหลืออาจแตกต่างกันไปตามเวอร์ชัน หากอุปกรณ์เครือข่ายอ่านแพ็กเก็ต IP และฟิลด์เวอร์ชันมีค่า 1787 โดยคาดว่าส่วนที่เหลือของแพ็กเก็ตจะเป็นไปตามโครงสร้าง IPv4 หากมีค่าอื่น เช่น 1797 ฟิลด์ที่เหลือจะแตกต่างกัน เช่นเดียวกับใน IPv6

ฟิลด์นี้ระบุความยาวของส่วนหัว

❓ทำไมต้องระบุความยาว? 🤔

ต่างจากอีเธอร์เน็ตที่ขนาดส่วนหัวได้รับการแก้ไข ความยาวส่วนหัวของ IPv4 อาจแตกต่างกันได้เนื่องจากฟิลด์เสริม สำหรับแพ็กเก็ต IP ที่ไม่มีตัวเลือกพิเศษ ส่วนหัวจะประกอบด้วย 1805 ไบต์ ซึ่งเป็นกรณีที่พบบ่อยที่สุด

ฟิลด์ IHL ไม่ได้ระบุความยาวเป็นไบต์โดยตรง แต่เป็นหน่วยคำขนาด 4 ไบต์ ดังนั้นเพื่อระบุความยาว 1815 ไบต์ ค่าจะเป็น 1820 (5 × 4 =20) การเข้ารหัสนี้อนุญาตให้ฟิลด์ใช้เพียง 4 บิตในขณะที่ระบุความยาวส่วนหัวได้สูงสุด 1831 ไบต์ (เมื่อ IHL =1844 ).

แพ็กเก็ต IPv4 ทั่วไปจึงเริ่มต้นด้วยไบต์ 1859 เป็นเลขฐานสิบหก ซึ่งหมายความว่าเป็นเวอร์ชัน 1863 ของโปรโตคอล IP และส่วนหัวคือ 1879 ไบต์ยาว

ประเภทของบริการ (TOS) (8 บิต)

แนวคิดเบื้องหลังฟิลด์นี้คือไม่ใช่ว่าแพ็กเก็ตทั้งหมดจะมีความสำคัญเท่ากัน คุณอาจต้องการให้ความสำคัญกับแพ็กเก็ตบางแพ็กเก็ตมากกว่าแพ็กเก็ตอื่น

ตัวอย่างเช่น แพ็กเก็ตที่ส่งข้อมูลแบบเรียลไทม์ (เช่น การประชุมด้วยเสียงหรือวิดีโอ) จะไวต่อเวลามากกว่าแพ็กเก็ตที่ส่งข้อมูล พูด อีเมล หรือดาวน์โหลดไฟล์ หากเราเตอร์กำลังประสบกับภาระงานสูง เราเตอร์ควรจัดลำดับความสำคัญของแพ็กเก็ตที่ไวต่อเวลาอย่างเหมาะสม

ช่องประเภทบริการอนุญาตให้ผู้ส่งระบุลำดับความสำคัญของแพ็กเก็ตของตนได้ อย่างไรก็ตาม บนอินเทอร์เน็ตสาธารณะ ฟิลด์นี้มักถูกละเลยโดยเราเตอร์ เนื่องจากผู้ส่งสามารถตั้งค่าลำดับความสำคัญใดก็ได้ ในกรณีส่วนใหญ่ ฟิลด์นี้มีค่า 1884 .

ความยาวทั้งหมด (16 บิต)

This field specifies the total length of the IP packet, including both the header and the payload (data).

❓ Why is this needed to specify the length? 🤔

Unfortunately, the IP layer doesn’t necessarily know if some of the bytes in the packet are actually a padding of the second layer. I described this in detail in a previous post, where I showed that in Ethernet protocol, in some cases, the receiving Ethernet entity cannot tell which bytes belong to the payload and which bytes are simply padding. The IP layer needs to know precisely which bytes belong to the actual packet, hence the Total Length field.

❓What is the maximum size of an IPv4 packet? 🤔

Since this field is 1897 bits long, an IPv4 packet may contain a maximum of 2^16-1 bytes, or 1900 bytes, including the header. The minimum size is 1917 bytes, consisting of just the header without options or payload.

Fragmentation Fields (32 bits)

The next four bytes are dedicated to fragmentation control. I’ll cover these fields in a separate section, as they involve a complex topic deserving special attention.

Time to Live (8 bits)

Despite its name, this field doesn't actually measure time but rather the maximum number of routing hops a packet can traverse before being discarded.

To understand its purpose, consider this scenario:If Machine A sends a packet to Machine B through a series of routers, but there's a routing loop where Router 2 sends to Router 3, which sends to Router 4, which sends back to Router 2, the packet could circulate indefinitely, consuming bandwidth and never reaching its destination.

The TTL field prevents this by setting a limit on how many hops a packet can take:

1. The sender sets an initial TTL value (often 1927 or 1936 )

2. Each router that handles the packet decrements the TTL by 1949

3. If a router receives a packet with TTL =1959 , it decrements it to 1963 and discards the packet

4. The router then sends an ICMP "Time Exceeded" message back to the original sender

This doesn't solve the underlying problem of routing loops, but it prevents packets from circulating forever.

In IPv6, this field is renamed "Hop Limit," which more accurately describes its function.

Protocol (8 bits)

This field describes the payload of the IPv4 packet. ตัวอย่างเช่น:

• A value of 1970 means the payload is TCP

• A value of 1982 means the payload is UDP

This helps the receiving system know which protocol handler should process the packet's contents. It's similar to the Type field in Ethernet, which specifies the protocol of the layer encapsulated within the Ethernet frame.

This is a 16-bit checksum used to verify the validity of the header only (that is, excluding the payload). The sender computes this value based on the fields of the header, and the receiver also computes it to validate that the header was received correctly.

❓The checksum must be recalculated by each router. ทำไมเป็นเช่นนั้น? 🤔

Because the TTL field changes at each hop. For example, if a packet starts with TTL =1993 , each router will:

1. Verify the current checksum based on TTL =2002

2. Decrement TTL to 2014

3. Calculate a new checksum based on TTL =2028

4. Forward the packet with the new checksum

If the checksum verification fails, the device drops the packet. This prevents packets with corrupted headers (which might have incorrect destination addresses, for instance) from being forwarded.

Source and Destination Addresses (32 bits each)

These fields contain the source and destination IPv4 addresses, respectively. Each is 4 bytes (32 bits) long, as you learned in the previous sections on IPv4 addressing.

Options (Variable Length)

Most IPv4 packets don't include options, but when present, they can provide additional functionality:

• Record Route :Each router that handles the packet adds its own address to this option, creating a trace of the packet's path

• Source Routing :Allows the sender to specify the route the packet should take:

  • Strict Source Routing:The entire route must be followed exactly

  • Loose Source Routing:Certain routers must be traversed, but the exact path between them is flexible

Padding

In some cases, the header ends with padding bytes (usually 2038 s).

❓Why does the IPv4 header have padding?🤔

As explained before, the IHL field specifies the header length in 4-byte units, so the total header length must be a multiple of 4 bytes. If options make the header length not divisible by 4, padding bytes (usually 2042 ) are added to reach the next multiple of 4.

For example, if you have 3 bytes of options, you would need 1 byte of padding to make the total header length a multiple of 4 bytes.

You've now learned about the structure of the IPv4 header, with the exception of the fragmentation fields which I’ll cover in the next section.

The IPv4 header efficiently packs all the necessary routing and control information into a compact structure, typically 20 bytes long (without options). This design allows for fast processing by routers while providing the flexibility needed for internet communication. It is amazing how prominent IPv4 is, even so many years after its publication.

In the next section, you'll learn about IPv4 fragmentation.

IPv4 Fragmentation

In the previous section, you learned about most of the IPv4 header structure, with the exception of 32 bits dedicated to fragmentation. This topic deserves special attention, as it reveals important aspects of how IP packets travel across different networks.

Why Fragmentation Is Needed

To understand what fragmentation is and why it's needed, consider the following network scenario:

In this diagram, you have two different networks where Machine A resides in one network and Machine B resides in another. A router forwards packets between these two networks.

These two networks have different Maximum Transmission Units (MTUs). MTU refers to the maximum size of a frame that can be transmitted in a network. ตัวอย่างเช่น:

• Machine B is connected to an Ethernet network with an MTU of 2052 bytes

• Machine A is connected to a different network with an MTU of 2064 bytes

Different MTUs stem from the different protocols and hardware that different networks have. Ethernet has an MTU of 2079 bytes. This maximum size was chosen because RAM was expensive back in the late 1970s when Ethernet was planned, and a receiver would need more RAM if a frame could be bigger. Other networks were devised at different times where RAM prices might have been lower, or just have other considerations that affect the MTU.

Now, consider this scenario:Machine A wants to send a packet to Machine B. This packet is 2085 bytes long. From A's perspective, there's no problem since its network supports packets of this size. Machine A transmits the packet.

When the router receives this packet, it faces a problem:it cannot simply forward the packet to B's network because the packet is too big for the network's MTU. The router must fragment the packet – splitting it into smaller chunks of up to 2091 bytes, which will then be reassembled by Machine B.

How Fragmentation Works in IP

Let's examine the scenario further. The router needs to take an IP packet of 2104 bytes and split it into two fragments, each consisting of up to 2110 bytes. If Machine A sends another packet of 2121 bytes to Machine B, the router will have to split that one too – resulting in four different fragments that will be reassembled into two separate packets.

When Machine B receives these fragments, it must ensure that it reassembles fragment #1 together with fragment #2 of packet A, and fragment #1 with fragment #2 of packet B – and not, for instance, fragment #1 of packet A with fragment #2 of packet B. It must also reassemble the fragments in the correct order – so structure a packet that consists of #1#2 and not #2#1.

Identification Field

First, focus on making sure Machine B reassembles fragments of the same packet (for example, fragment #1 and fragment #2 of packet A in the example above, rather than fragment #1 of packet A and fragment #2 of packet B). This is achieved using the identification field of IPv4. Fragments belonging to the same packet will have the same identification value. For example, both fragments of packet A might have identification set to 2135 , and both fragments of packet B might have identification of 2146 .

It's important to note that sharing identification values isn't sufficient for fragments to belong to the same packet. Fragments of the same packet must also share:

• The same source IP address

• The same destination IP address

• The same protocol value (indicating whether the payload is TCP, UDP, and so on)

Fragment Offset

Since IP is a connectionless protocol, there's no guarantee that fragments will arrive at Machine B in the correct order. Fragment #2 of packet A may arrive before fragment #1. To handle this issue, each fragment carries an Offset field, which denotes the offset from the beginning of the original packet.

The Offset field consists of 13 bits, which means it can carry values from 2154 to 2160 (2^13-1). This poses a potential problem, as the maximum size of an IP packet can be 2170 bytes (since the Total Length field of the IP header consists of 16 bits).

To address this limitation, the value encoded in the Offset field is actually multiplied by 2180 (2^3). This means the minimum size of a fragment is 2199 bytes, with the exception of the last fragment.

❓Why do IP packets carry an offset in bytes divided by 8, instead of just a sequential fragment number?🤔

While using sequence numbers might seem simpler, it would create problems when packets need to be fragmented multiple times.

For example, if Computer A sends a packet to the first router, which fragments it into pieces of 2200 bytes and 2217 bytes, and then these fragments are sent to another router that needs to fragment them again into even smaller pieces, how would you number them?

With byte offsets, the solution is straightforward – if the first fragment has an offset of 2226 and the next one has an offset of 2237 , then if we need to split them into maximum 2243 -byte fragments, we'd have:

• First fragment:2258 bytes with offset 2266

• Second fragment:2279 bytes with offset 2289

• Third fragment:2290 bytes with offset 2308

More Fragments and Don't Fragment Flags

When Machine B receives a fragment, it needs to know whether this is an entire packet by itself or if it should expect additional fragments. For this purpose, each IP fragment carries a More Fragments (2313 ) bit that is set to 2329 for every fragment that is not the last fragment of the packet. For the last fragment, it's set to 2335 .

In case the packet consists of a single fragment – the 2342 bit will be set to 2351 , and the offset field will also hold the value 2369 (that is, 13 bits of 2373 s).

Another bit related to fragmentation is the Don't Fragment (2381 ) bit. When this flag is turned on, intermediate devices should not fragment the original packet, even if it exceeds the MTU. Instead, they should drop it and typically send an ICMP "Fragmentation Needed" message back to the source.

In our example, if Machine A sets the Don't Fragment bit to 2399 , the router would drop the packet, and notify Machine A about it.

Note that right after the identification field and before the 2402 flag, there is a reserved bit set to 2414 . This bit was reserved in case it is needed in the future, for a reason unknown to the original authors of IPv4.

Fragmentation Example

Consider again our example above – with Machine A residing in a network where the MTU is 2420 , and Machine B residing in a network where the MTU is 2430 . Machine A sends a packet which is 2448 bytes long.

❓Can you fill the values in these tables?

First Fragment: Total Length IdentificationDon’t FragmentMore FragmentsOffset

Second Fragment: Total Length IdentificationDon’t FragmentMore FragmentsOffset

For our example above, the values of the relevant fragmentation fields in IP would be as follows:

First Fragment:

• Total Length:2455 (including 2460 bytes of IP header, so 2475 bytes of payload)

• Identification:2487 (arbitrary value)

• Don't Fragment bit:2490 (off, to allow further fragmentation if needed)

• More Fragments bit:2506 (on, as this is not the last fragment)

• Offset:2510 (it's the first fragment)

Second Fragment:

• Total Length:2527 (including 2538 bytes of IP header, so 2543 bytes of payload – together with the first fragment, we get to 2550 bytes of payload)

• Identification:2560 (same as first fragment, indicating they belong together)

• Don't Fragment bit:2579 (off, to allow further fragmentation if needed)

• More Fragments bit:2582 (off, as this is the last fragment)

• Offset:2592 (1480/8 =185, or 2606 in hexadecimal)

IPv4 Fragmentation – Summary

You've now learned about the final part of the IPv4 Header:fragmentation. Fragmentation is necessary to allow packets to travel across networks with different MTUs. The IPv4 header includes several fields specifically designed to support fragmentation:

• Identification (16 bits):Identifies which fragments belong together

• Flags (3 bits):Including the "More Fragments" and "Don't Fragment" flags

• Fragment Offset (13 bits):Indicates where in the original packet this fragment belongs

With this knowledge, you now understand every bit and byte of the IPv4 header and how IP packets can traverse networks with different characteristics.

Summary – IPv4

In this comprehensive guide to IPv4, you've learned about the fundamental building blocks of Internet communications. Let's recap the key concepts we covered:

Addressing and Network Structure

• IPv4 addresses are 32-bit numbers typically written in dotted decimal notation

• Networks can be identified using various methods:

  • Fixed-length approach (historically)

  • Classful addressing (A, B, C, D, E classes)

  • CIDR (modern approach allowing flexible network sizes)

• Special addresses serve specific purposes:

  • 2610 for "this host"

  • 2625 for loopback

  • 2636 for broadcast

• The header contains crucial fields for packet routing and processing:

  • Version and IHL for header interpretation

  • Type of Service for traffic prioritization

  • Total Length for packet size

  • Various fields for fragmentation control

  • TTL to prevent infinite routing loops

  • Protocol to identify the encapsulated protocol

  • Checksum for error detection

  • Source and destination addresses

Fragmentation

• Allows IPv4 packets to traverse networks with different MTUs

• Uses three key fields:

  • Identification to group fragments

  • Flags to control fragmentation

  • Fragment Offset to reassemble packets

Final Words

While IPv4 has limitations, particularly its address space constraints, its elegant design and robust features have allowed it to remain the backbone of the Internet for over four decades. Understanding IPv4 provides essential context for working with modern networks and helps in transitioning to newer protocols like IPv6.

About the Author

Omer Rosenbaum is Swimm’s Chief Technology Officer. He's the author of the Brief YouTube Channel. He's also a cyber training expert and founder of Checkpoint Security Academy. He's the author of Gitting Things Done (in English) and Computer Networks (in Hebrew). You can find him on Twitter.

Additional References

• Computer Networks Playlist - on my Brief channel

เรียนรู้การเขียนโค้ดฟรี หลักสูตรโอเพ่นซอร์สของ freeCodeCamp ช่วยให้ผู้คนมากกว่า 40,000 คนได้งานในตำแหน่งนักพัฒนา เริ่มต้น