Course: COMP347 Computer Networks (Revision 10) | Textbook: Kurose & Ross, Computer Networking: A Top‑Down Approach (9th ed.)
Upon completion of this tutorial, students should be able to:
The Internet Protocol version 4 (IPv4) is the workhorse of the network layer, responsible for delivering datagrams from source to destination across the Internet. IPv4 defines the format of datagrams, addressing schemes, and the rules for handling packets. This tutorial provides a comprehensive examination of the IPv4 datagram structure, explaining each header field in detail, and covers the fundamentals of IP addressing, including classful addressing (historical), special addresses, and the role of DHCP. Understanding the IPv4 datagram is essential for grasping how the data plane operates, as routers and hosts examine these fields to forward, fragment, and process packets.
IPv4 provides a connectionless, best‑effort service. This means:
This design is intentional to keep the network layer simple and scalable, allowing the Internet to grow to its current size.
The IPv4 datagram consists of a fixed‑length header (20 bytes minimum) and a variable‑length payload (data). The maximum total size is 65,535 bytes (16‑bit total length field).
| Field | Size (bits) | Description |
|---|---|---|
| Version | 4 | IP version (4 for IPv4). |
| IHL (Internet Header Length) | 4 | Length of header in 32‑bit words. Minimum 5 (20 bytes). |
| DSCP (DiffServ Code Point) | 6 | Used for Quality of Service (QoS) differentiation. |
| ECN (Explicit Congestion Notification) | 2 | Indicates network congestion. |
| Total Length | 16 | Total datagram length (header + data) in bytes. Max 65,535. |
| Identification | 16 | Used for fragmentation; unique identifier for each datagram. |
| Flags | 3 | Control fragmentation: DF (Don't Fragment), MF (More Fragments). |
| Fragment Offset | 13 | Offset of this fragment in 8‑byte units from the start of the datagram. |
| Time to Live (TTL) | 8 | Maximum hops; decremented by each router. Prevents loops. |
| Protocol | 8 | Identifies the upper‑layer protocol (e.g., TCP=6, UDP=17, ICMP=1). |
| Header Checksum | 16 | Error detection for the header only. Recalculated at each hop. |
| Source Address | 32 | IPv4 address of the sending host. |
| Destination Address | 32 | IPv4 address of the receiving host. |
| Options | Variable | Optional fields for security, record route, timestamp, etc. |
| Padding | Variable | Ensures header ends on a 32‑bit boundary. |
An IPv4 address is a 32‑bit number, typically written in dotted‑decimal notation (e.g., 192.168.1.1). Each address has two parts: the network portion (identifies the network) and the host portion (identifies the specific device on that network). The division is determined by the subnet mask (or prefix length).
Originally, addresses were divided into classes:
| Class | First Octet Range | Network/Host Bits | Number of Networks | Hosts per Network |
|---|---|---|---|---|
| A | 0–127 | 8 / 24 | 126 | 16.7 million |
| B | 128–191 | 16 / 16 | 16,384 | 65,534 |
| C | 192–223 | 24 / 8 | 2,097,152 | 254 |
| D | 224–239 | Multicast | ||
| E | 240–255 | Reserved / Experimental | ||
Classful addressing was inefficient (e.g., Class B was too large for many organizations, Class C too small). This led to CIDR (Classless Inter‑Domain Routing), which allows arbitrary prefix lengths.
DHCP is a client‑server protocol used to assign IP addresses dynamically, along with other configuration parameters (subnet mask, default gateway, DNS servers). DHCP operates at the application layer but is crucial for network‑layer addressing.
DHCP Operation (DORA):
IP addressing is hierarchical: the network portion identifies the network, and routers use this to forward packets. Aggregation (summarization) of routes reduces the size of routing tables. For example, a provider with multiple subnets can advertise a single prefix to the rest of the Internet, reducing routing table growth.
The checksum is calculated over the header (excluding options if present). The algorithm:
To verify, compute the sum over the entire header (including checksum). The result should be 0xFFFF (all ones).
IP Options: Include Record Route, Timestamp, Loose Source Routing, and Strict Source Routing. However, options are rarely used because they slow forwarding and are often blocked by firewalls for security reasons.
Security: The TTL field can be used to infer the distance to a host (traceroute). IP spoofing (forging source addresses) is a common attack, mitigated by ingress filtering (BCP 38).
Evolution: IPv4 has been extended with features like ECN and DSCP. The primary replacement is IPv6, which addresses the exhaustion of IPv4 addresses and simplifies the header.
Q1. Which field in the IPv4 header indicates the version of IP?
B) Version
Q2. The IHL field is measured in:
B) 32‑bit words
Q3. What is the minimum size of an IPv4 header (in bytes) without options?
A) 20 (IHL = 5, 5*4 = 20)
Q4. Which field is used to prevent packets from looping indefinitely?
C) TTL
Q5. The Total Length field is 16 bits. What is the maximum datagram size?
B) 65,535 bytes
Q6. Which flag is used to indicate that the datagram should not be fragmented?
B) DF
Q7. What is the protocol number for TCP?
B) 6
Q8. Which of the following is a private IP address range defined in RFC 1918?
D) Both A and C (also 172.16.0.0/12)
Q9. The loopback address is:
B) 127.0.0.1 (entire 127.0.0.0/8 is loopback)
Q10. Which field in the IPv4 header is recalculated at every hop?
C) Header Checksum (because TTL changes)
Q11. In classful addressing, which class has the first octet range 192‑223?
C) Class C
Q12. What is the network address of the subnet 192.168.5.0/24?
A) 192.168.5.0
Q13. The broadcast address for 192.168.5.0/24 is:
B) 192.168.5.255
Q14. DHCP is used to:
B)
Q15. The Fragment Offset field is measured in units of:
C) 8 bytes
Q16. Explain the purpose of the TTL field and what happens when it reaches zero.
The TTL (Time To Live) field prevents packets from looping indefinitely in the network. Each router decrements the TTL by 1. When it reaches 0, the router discards the packet and sends an ICMP Time Exceeded message (type 11) back to the source, informing the source that the packet has been dropped.
Q17. Why does the IP header checksum only cover the header and not the payload?
Because upper‑layer protocols (like TCP and UDP) already provide end‑to‑end error detection for the entire segment (including payload). Computing the checksum over the payload at the IP layer would be redundant and costly in terms of processing, especially since the header changes at each hop. The header checksum ensures the integrity of the header, which is critical for forwarding.
Q18. Distinguish between the network address, broadcast address, and host address in a subnet.
Network address: all host bits are 0; identifies the subnet. Broadcast address: all host bits are 1; used to send a packet to all hosts on the subnet. Host address: any address between network and broadcast addresses; assigned to individual devices.
Q19. What is the purpose of the Protocol field in the IPv4 header?
The Protocol field specifies the transport‑layer protocol (or other upper‑layer protocol) to which the payload should be delivered. For example, 6 means TCP, 17 means UDP, 1 means ICMP. This allows the receiving host's network layer to demultiplex the datagram to the correct higher‑layer entity.
Q20. Explain the difference between unicast, broadcast, and multicast addressing in IPv4.
Unicast: one‑to‑one communication; a packet is sent to a single specific host. Broadcast: one‑to‑all; a packet is sent to all hosts on a subnet (address with host bits all 1). Multicast: one‑to‑many; a packet is sent to a group of hosts that have joined a multicast group (Class D addresses).
Q21. A router receives an IPv4 datagram with the following header values (hex): 45 00 00 28 12 34 00 00 20 06 00 00 0A 01 02 03 0A 01 02 04. What is the IHL, total length, TTL, protocol, source address, and destination address?
Bytes: 45 (Version=4, IHL=5), 00 (DSCP/ECN), 00 28 (Total Length=40), 12 34 (ID=4660), 00 00 (flags/offset), 20 (TTL=32), 06 (Protocol=6, TCP), 00 00 (checksum=0), 0A 01 02 03 (Source=10.1.2.3), 0A 01 02 04 (Dest=10.1.2.4). IHL=5 (20 bytes), Total Length=40 bytes, TTL=32, Protocol=6 (TCP).
Q22. A host has an IP address of 172.16.5.15 with a subnet mask of 255.255.255.0. What is the network address, broadcast address, and the range of usable host addresses?
Network address: 172.16.5.0. Broadcast: 172.16.5.255. Usable hosts: 172.16.5.1 – 172.16.5.254 (254 hosts).
Q23. A datagram has the DF flag set. The link MTU is 1500 bytes, but the datagram is 2000 bytes. What happens?
Since DF (Don't Fragment) is set, the router cannot fragment the datagram. It will drop the packet and send an ICMP Fragmentation Needed (Destination Unreachable, type 3, code 4) message to the source, indicating that the datagram is too large and fragmentation is required but prohibited.
Q24. Explain the four steps of DHCP (DORA) and the purpose of each step.
1. Discover: Client broadcasts to locate DHCP servers. 2. Offer: Server(s) reply with an available IP address offer. 3. Request: Client selects an offer and requests that address. 4. Acknowledgment: Server assigns the address and provides lease time and configuration parameters.
Q25. A router receives an IP packet with TTL=1. What action does the router take, and what ICMP message, if any, is sent?
The router decrements TTL to 0, so it discards the packet. It then sends an ICMP Time Exceeded (type 11, code 0) message to the source, indicating that the TTL expired in transit.
Q26. Given the IPv4 header checksum algorithm, explain why the checksum is 0xFFFF when verified correctly.
When verifying, the receiver computes the one's complement sum of all 16‑bit words in the header, including the checksum field. The sender set the checksum such that the sum of the header (including checksum) is 0xFFFF. Thus, if the header is valid, the result of the one's complement addition (with carry‑around) will be 0xFFFF.
Q27. What is the role of the Identification field in IPv4 fragmentation and reassembly?
The Identification field is used to associate fragments of the same original datagram. All fragments of a given datagram have the same Identification value. The receiving host uses this field to group fragments together for reassembly.
Q28. Describe the effect of the ECN field on TCP performance.
ECN (Explicit Congestion Notification) allows routers to mark packets when they are experiencing congestion, rather than dropping them. TCP senders that support ECN can reduce their sending rate in response to congestion notifications, avoiding packet loss and improving performance. ECN works in conjunction with RED/AQM.
Q29. Why is classful addressing considered inefficient, and how did CIDR address this?
Classful addressing wasted address space because organizations often needed more than a Class C but fewer than a Class B, leading to unused addresses. CIDR introduced variable‑length prefixes, allowing arbitrary splitting of address blocks, which enabled efficient allocation and route aggregation.
Q30. What is the purpose of the Options field in the IPv4 header, and why are they rarely used today?
Options provide additional features like record route, timestamp, and source routing. They are rarely used because they increase header processing time (slow forwarding), can be a security risk (source routing), and are often blocked by routers and firewalls. Most modern routers ignore or drop packets with options.
Q31. How does a host determine its subnet mask? List two methods.
1. DHCP: The server provides the subnet mask. 2. Statically configured: The administrator sets it manually. 3. For link‑local addresses, the mask is /16 (255.255.0.0).
Q32. What is the purpose of the Padding field in the IPv4 header?
Padding ensures that the header length is a multiple of 32 bits (4 bytes). Since the IHL field counts in 32‑bit words, padding (with zeros) is added after the Options field to align the header on a 32‑bit boundary.
Q33. Explain how a router uses the Total Length and IHL fields to locate the start of the data in an IPv4 datagram.
The start of the data is at offset (IHL * 4) bytes from the beginning of the datagram. The Total Length field gives the total datagram size. The data size = Total Length - (IHL * 4).
Q34. What is the difference between a directed broadcast and a limited broadcast address?
A directed broadcast is sent to a specific network (e.g., 192.168.1.255) and is routed to that network. A limited broadcast is 255.255.255.255 and is not routed; it is sent only to the local network.
Q35. Why is the IP header checksum not required in IPv6?
IPv6 removes the header checksum to simplify processing and speed up forwarding. Error detection is left to the link layer and transport layer. The assumption is that link‑layer checksums (e.g., Ethernet) already provide sufficient error detection for most links.
Convert the following dotted‑decimal IP addresses to binary: a) 192.168.1.1 b) 10.0.0.1 c) 172.16.5.10
a) 192=11000000, 168=10101000, 1=00000001, 1=00000001 → 11000000.10101000.00000001.00000001
b) 10=00001010, 0=00000000, 0=00000000, 1=00000001 → 00001010.00000000.00000000.00000001
c) 172=10101100, 16=00010000, 5=00000101, 10=00001010 → 10101100.00010000.00000101.00001010
What is the network address, broadcast address, and usable host range for the following: a) 192.168.10.25/24 b) 10.5.5.100/16
a) /24: network 192.168.10.0, broadcast 192.168.10.255, hosts 192.168.10.1‑254.
b) /16: network 10.5.0.0, broadcast 10.5.255.255, hosts 10.5.0.1‑10.5.255.254.
Given the IP header fields (in hex): 45 00 00 30 12 34 00 00 20 06 00 00 0A 01 02 03 0A 01 02 04. Calculate the Header Checksum (the field is currently 0x0000). Show your work.
Sum 16‑bit words: 0x4500 + 0x0030 + 0x1234 + 0x0000 + 0x2006 + 0x0000 + 0x0A01 + 0x0203 + 0x0A01 + 0x0204.
0x4500+0x0030=0x4530; +0x1234=0x5764; +0x0000=0x5764; +0x2006=0x776A; +0x0000=0x776A; +0x0A01=0x816B; +0x0203=0x836E; +0x0A01=0x8D6F; +0x0204=0x8F73. One's complement = 0xFFFF - 0x8F73 = 0x708C. So checksum = 0x708C.
What is the IHL if the header has 40 bytes? How many 32‑bit words is that?
IHL = 40 / 4 = 10. In binary, 10 is 1010. Header length = 10 * 4 = 40 bytes.
An IPv4 datagram has the MF flag set to 1, and the Fragment Offset is 0. What does this indicate?
MF=1 means there are more fragments to come. Fragment Offset=0 means this is the first fragment of the datagram (starting at offset 0).
Draw the IPv4 header structure and label all fields with their bit lengths.
The diagram is in the tutorial content. Students should reproduce it with correct placements and bit lengths (4,4,8,16,16,3,13,8,8,16,32,32, variable options, padding).
A router receives a packet with TTL=2 and needs to forward it to the next hop. What is the new TTL after forwarding? What happens if TTL was 1 before forwarding?
If TTL=2, after decrement it becomes 1, and the packet is forwarded. If TTL=1, after decrement it becomes 0, and the router drops the packet.
Explain the purpose of the Differentiated Services Code Point (DSCP) field in the IPv4 header.
DSCP is used to classify packets for Quality of Service (QoS). It allows network operators to assign different levels of forwarding priority to different types of traffic (e.g., voice, video, data). Routers can use DSCP to implement differentiated services (DiffServ) by providing preferential treatment to high‑priority traffic.
Given the subnet mask 255.255.255.240, how many host addresses are available per subnet?
Mask 255.255.255.240 means /28 (32‑28 = 4 host bits). Number of host addresses = 2^4 = 16. Usable addresses = 16 ‑ 2 (network and broadcast) = 14.
Why does the total length field include both header and data? How does a router determine the length of the data?
Total length includes both to indicate the size of the entire datagram for reception and buffer management. Data length = Total Length - (IHL * 4).
Identify the address class for each: a) 10.0.0.1 b) 172.16.0.1 c) 192.168.1.1 d) 224.0.0.1.
a) Class A (10 < 128) b) Class B (128‑191) c) Class C (192‑223) d) Class D (224‑239).
A datagram has the DF flag set to 0. The link MTU is 500 bytes, and the datagram is 1500 bytes. Describe the fragmentation process.
Since DF=0, the router can fragment. The datagram is split into multiple fragments. Each fragment has its own IP header. The Fragment Offset is set to the offset in 8‑byte units. MF flag is set to 1 for all but the last fragment.
What is the purpose of the Protocol field in demultiplexing at the receiving host?
The Protocol field tells the receiving host's network layer which transport‑layer protocol (or other upper‑layer protocol) to pass the payload to. For example, if Protocol=6, the payload is passed to TCP; if 17, to UDP; if 1, to ICMP.
Explain how a host uses the broadcast address to send a packet to all hosts on its local network.
The host sets the destination address to the broadcast address of its subnet (e.g., 192.168.1.255 for /24). The packet is sent to the link‑layer broadcast address, and all hosts on the subnet receive and process it.
Describe the role of DHCP in IP address management and list three parameters it can provide besides the IP address.
DHCP automates IP address assignment and configuration. Besides the IP address, it provides: 1) Subnet mask, 2) Default gateway, 3) DNS server addresses. It can also provide NTP servers, domain name, etc.
Write a detailed explanation of the IPv4 header fields, including their purpose and how they are used in the forwarding process. Include a diagram.
See the content in Section 3.3. A comprehensive answer would describe each field with its size, purpose, and interaction with other fields. Include the diagram.
Compare and contrast classful and classless (CIDR) addressing. Explain why CIDR is superior and how it enables route aggregation.
Classful addressing uses fixed boundaries (8, 16, 24 bits) leading to inefficient use of address space. CIDR allows arbitrary prefix lengths, enabling efficient allocation and aggregation. Example: a provider can announce a /19 instead of multiple /24s.
Given the following IP addresses and subnet masks, determine the network address, broadcast address, and usable host range: a) 172.16.5.10 255.255.255.192 b) 10.10.10.100 255.255.0.0 c) 192.168.100.200 255.255.255.224.
a) /26: network 172.16.5.0, broadcast 172.16.5.63, hosts 1‑62.
b) /16: network 10.10.0.0, broadcast 10.10.255.255, hosts 0.1‑255.254.
c) /27: network 192.168.100.192, broadcast 192.168.100.223, hosts 193‑222.
Explain the DHCP DORA process in detail, including the source and destination addresses at each step. Why are some steps broadcast and some unicast?
Discover: source 0.0.0.0, dest 255.255.255.255 (broadcast). Offer: source server IP, dest 255.255.255.255 (broadcast) because client has no IP yet. Request: source 0.0.0.0, dest 255.255.255.255 (broadcast). Ack: source server IP, dest client IP (unicast) after client has an IP. Broadcasts are used because the client does not know its IP or server's IP initially.
What are the security implications of IP spoofing? How can ingress filtering (BCP 38) mitigate it?
IP spoofing is forging the source address to hide the sender's identity or to launch attacks (e.g., amplification attacks). Ingress filtering (RFC 2827/BCP 38) checks that packets arriving on an interface have source addresses from the expected block, preventing spoofed packets from leaving a network.
Calculate the header checksum for a datagram with the following 16‑bit words: 0x4500, 0x003C, 0x1A2B, 0x0000, 0x4006, 0x0000, 0xC0A8, 0x0102, 0xC0A8, 0x0103. Show all steps.
Sum: 0x4500+0x003C=0x453C; +0x1A2B=0x5F67; +0x0000=0x5F67; +0x4006=0x9F6D; +0x0000=0x9F6D; +0xC0A8=0x16015 (wrap: 0x6016); +0x0102=0x6118; +0xC0A8=0x121C0 (wrap: 0x21C1); +0x0103=0x22C4. One's complement = 0xFFFF - 0x22C4 = 0xDD3B. Checksum = 0xDD3B.
Explain the use of the Flags field (DF and MF) in fragmentation. Provide a scenario where each flag is useful.
DF (Don't Fragment) is used when the application requires that the datagram not be fragmented (e.g., for UDP with PMTUD). MF (More Fragments) indicates that this fragment is not the last; it is used to signal the receiver that more fragments will follow.
Describe the concept of "IP address depletion" and how private addresses and NAT help mitigate it.
IPv4 has only 2^32 addresses (≈4.3 billion). The allocation was inefficient, leading to exhaustion. Private addresses (RFC 1918) allow many hosts to share a single public address via NAT, conserving public IP addresses and delaying depletion.
What is the maximum number of IPv4 addresses? Explain why the actual number is less than 2^32.
Theoretical max is 2^32 = 4,294,967,296. However, some are reserved: loopback, private addresses, multicast, experimental, and broadcast, reducing the number of publicly routable unicast addresses.
Explain how traceroute uses the TTL field to discover the path to a destination.
Traceroute sends a series of packets with increasing TTL values (starting at 1). Each router that receives a packet with TTL=1 discards it and sends an ICMP Time Exceeded message to the source. Traceroute records the source IP of each ICMP message, revealing the path. It continues until the destination responds with a port unreachable (or similar) when TTL is large enough to reach it.
Research the history of IPv4 address allocation. Describe the role of IANA and the regional Internet registries (RIRs) in managing the address space.
IANA (Internet Assigned Numbers Authority) allocates large address blocks to RIRs (e.g., ARIN, RIPE, APNIC). RIRs then allocate to ISPs and organizations. This hierarchical management ensures global uniqueness and efficient allocation.
What is the purpose of the Padding field? Why is it sometimes necessary?
Padding ensures that the header length is a multiple of 4 bytes (32 bits). The IHL field counts 32‑bit words, so if options are present and the header length is not a multiple of 4, padding (zeros) is added to reach the next 4‑byte boundary.
Explain the difference between a physical address (MAC) and an IP address. Which is used for forwarding across networks?
MAC address is a link‑layer address, unique per interface, used for communication within a local network. IP address is a network‑layer address, used for global end‑to‑end communication across networks. Routers use IP addresses to forward packets; link‑layer frames use MAC addresses for delivery on the local link.
Given a datagram with Total Length = 1500 bytes and IHL = 5, what is the size of the payload?
Header = IHL * 4 = 20 bytes. Payload = 1500 - 20 = 1480 bytes.
Write a short essay on the limitations of IPv4 and the motivation for IPv6, focusing on addressing and header efficiency.
IPv4 limitations: address exhaustion (despite NAT), complex header (options, checksum), inefficient fragmentation. IPv6 provides 128‑bit addresses, simplified header (fixed 40 bytes, no checksum, no fragmentation in routers), and built‑in security (IPsec). IPv6 also enables better route aggregation and autoconfiguration.
This tutorial has provided a comprehensive exploration of the IPv4 datagram structure and addressing. Key takeaways:
In the next tutorial, we will dive into subnetting, CIDR, and address aggregation, building on the addressing concepts introduced here.