The IPv4 packet header: TTL, fragmentation, DSCP and the protocol field explained
In short: Every IPv4 packet starts with a header of at least 20 bytes. It carries the source and destination addresses, a TTL that stops packets looping forever, fragmentation fields, a DSCP value for QoS and a protocol number that says what is inside. Knowing these fields makes packet captures and MTU problems much easier to understand.
Why learn the header?
When you open a capture in Wireshark, write a firewall rule or troubleshoot a VPN that "connects but nothing loads", you are dealing with IPv4 header fields. You don't need to memorise bit positions, but you should know what each field does and which ones change as a packet travels.
The fields that matter most
| Field | What it does | Changes in transit? |
|---|---|---|
| Version and IHL | Always 4 for IPv4; IHL gives the header length in 32-bit words (5 = 20 bytes) | No |
| DSCP and ECN | The old Type of Service byte. 6 bits of DSCP mark traffic class for QoS (EF, value 46, for voice); 2 ECN bits signal congestion without dropping | Can be re-marked at trust boundaries |
| Total length | Size of header plus data in bytes, up to 65,535 | Only if fragmented |
| Identification, flags, fragment offset | Let the receiver reassemble fragments. Flags include DF (Don't Fragment) and MF (More Fragments) | Set when fragmenting |
| Time to live (TTL) | Each router subtracts 1; at 0 the packet is dropped and an ICMP Time Exceeded message is sent back | Yes, every hop |
| Protocol | What the payload is: 1 ICMP, 6 TCP, 17 UDP, 47 GRE, 50 ESP, 89 OSPF | No |
| Header checksum | Detects damage to the header only (not the data) | Recalculated every hop because TTL changes |
| Source and destination address | 32-bit IPv4 addresses | Only when NAT rewrites them |
TTL: stopping loops and tracing paths
If a routing mistake sends a packet round in a circle, TTL guarantees it eventually dies instead of circulating forever. Operating systems start at different values (commonly 64 for Linux and macOS, 128 for Windows, 255 for many network devices), so the TTL you see in a reply gives a rough hint about the sender and how many hops away it is. Traceroute deliberately sends packets with TTL 1, 2, 3 and so on to make each router reveal itself.
Fragmentation and MTU problems
A router that must forward a packet larger than the next link's MTU has two choices. If DF is clear, it can split the packet into fragments, which the destination reassembles. If DF is set, it drops the packet and sends back ICMP "fragmentation needed" (type 3, code 4) with the MTU it can handle. Modern hosts set DF and use this feedback to find the largest size that works end to end: path MTU discovery.
Tunnels such as GRE, IPsec and PPPoE add headers, so the usable MTU inside them is smaller than 1500. If a firewall blocks the ICMP feedback, large packets silently disappear while small ones work. This "black hole" is why you should never block all ICMP. Common fixes are clamping the TCP MSS on the tunnel interface and allowing ICMP type 3.
ping 192.0.2.10 -f -l 1472 (Windows: DF set, 1472 + 28 header bytes = 1500)
ping -M do -s 1472 192.0.2.10 (Linux equivalent)
interface Tunnel0
ip mtu 1400
ip tcp adjust-mss 1360Real-world example: after a site moved to a PPPoE broadband line, staff could load some web pages but others hung half-way and file uploads failed. Pings with 1472-byte packets and DF set failed while 1464 worked, because PPPoE uses 8 bytes. Setting ip tcp adjust-mss 1452 on the WAN interface solved it without touching any PC.
Practice
A packet leaves a host with TTL 64 and crosses three routers. What TTL does it arrive with?
Why is the header checksum recalculated at every router?
Small pings work through a VPN but large file transfers stall. What is a likely cause and fix?
Key takeaways
- The IPv4 header is normally 20 bytes and carries addresses, TTL, protocol, DSCP and fragment fields.
- TTL drops by one per router and stops routing loops; traceroute relies on it.
- The protocol field identifies the payload: 1 ICMP, 6 TCP, 17 UDP, 50 ESP.
- DF plus ICMP type 3 code 4 drives path MTU discovery; blocking that ICMP creates black holes.
- Tunnels reduce the usable MTU, so clamp the TCP MSS on tunnel interfaces.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.