The meaning of each bit is as follows.įor unfragmented packets, the MF flag is set to be 0.įor fragmented packets, bit 0 set to be 0, bit 1 is set to be 0 and bit 2 is set to be 1 (However, in case of the last fragment of the fragmented packets all bits are set to be 0) This field (3 bits) is used to control and indentify the fragments.

This field (16 bits) is used to uniquely identify a group of fragments that belongs to the same IP diagram. the minimum length of one IP packet is 20 bytes which is the case in which there is only IP header and No payload. This means the max length of one IP packet is 2^16 Bytes (65535 bytes) including the header. The minimum value is 20 bytes since the minimum IPv4 header length is 20 bytes. This field (16 bits) indicates the total length of the IP packet (Length of IP header + Length of payload) in bytes. So, if the value of this field is 5, it means the length of IP header is 20 bytes (= 5 x 4 bytes). This field (4 bit) indicates the length of the IP header and the unit is 4 bytes (32 bits). 00 – Non ECN-Capable Transport, Non-ECT.This field (2 bits) is used for end to end notification of Network Congestion. This field (6 bits) used to be called ToS('Type of Service') and now renamed to DSCP.

It is always 4 in IPv4 header.ĭSCP (Differentiated Services Code Point) This field (4 bits) indicates IP version. Options (if IHL > 5) : This field exists only when the length of IPv4 header is greater than 20.

Wireshark ip header checksum