Header Field Maps

Compact field-by-field tables for the headers covered across this course, in one place for lookup.

IPv4 header

Field	Bytes / bits	Purpose
Version	4 bits	IP version - 4 for IPv4
IHL	4 bits	Header length in 32-bit words (accounts for options)
ToS / DSCP	1 byte	Differentiated Services Code Point - marks traffic for QoS/priority handling
Total length	2 bytes	Length of header plus payload, in bytes
Identification	2 bytes	Groups fragments that belong to the same original packet
Flags	3 bits	DF (don't fragment) and MF (more fragments follow)
Fragment offset	13 bits	Where this fragment's data starts, in 8-byte units, within the original packet
TTL	1 byte	Decremented at each hop; packet is dropped when it hits 0 (prevents routing loops)
Protocol	1 byte	Which transport protocol is inside - 6 = TCP, 17 = UDP, 1 = ICMP
Header checksum	2 bytes	Error-check over the IP header only (recomputed at every hop, since TTL changes)
Source address	4 bytes	Sending host's IP
Destination address	4 bytes	Receiving host's IP

⚠No payload checksum

IP's checksum covers only its own header - not the payload. Payload correctness is left to the transport layer (TCP/UDP checksums) and the link layer (Ethernet FCS). This is also why the IP checksum must be recalculated at every hop: TTL changes on every hop, so the header it covers changes too.

TCP header

The full derivation and flag-by-flag breakdown lives in The TCP Segment Header; this is the same fields, compressed for lookup.

Field	Bytes / bits	Purpose
Source port	2	Local socket that sent this segment
Destination port	2	Socket on the receiver to demux to
Sequence number	4	Byte offset of the first data byte in this segment
Acknowledgment number	4	Next byte the sender of this segment expects to receive
Header length	4 bits	TCP header length in 32-bit words
Flags	9 bits	SYN, ACK, FIN, RST, PSH, URG (+ 3 congestion-notification bits)
Window	2	Receive window (rwnd) - flow control
Checksum	2	Error-detection over header, payload, and a pseudo-header of IP fields
Urgent pointer	2	Offset to urgent data, only meaningful when URG is set
Options	0-40	Variable-length extensions - MSS, window scaling, SACK, timestamps

UDP header

UDP's header is a fraction of TCP's size - no sequencing, no window, no options, just enough to demultiplex and error-check.

Field	Bytes	Purpose
Source port	2	Local socket that sent this datagram
Destination port	2	Socket on the receiver to demux to
Length	2	Length of header plus payload, in bytes
Checksum	2	Error-detection over header, payload, and a pseudo-header of IP fields (optional in IPv4, mandatory in IPv6)

Ethernet frame

Full context on frames, switching, and forwarding lives in Switches & Ethernet; the field table alone, for lookup:

Field	Size	Purpose
Preamble	8 bytes	Sync the receiver's clock; mark the start of a frame
Destination MAC	6 bytes	Which interface on this link should receive the frame
Source MAC	6 bytes	Which interface sent it (how switches self-learn)
Type	2 bytes	Which protocol is inside (0x0800 = IPv4, 0x0806 = ARP, 0x86DD = IPv6)
Payload	46-1500 bytes	The network-layer packet (padded up to the 46-byte minimum)
FCS	4 bytes	Frame Check Sequence - a CRC over the frame for error detection