cdeclog

IP Header

Notes:

1. Time to Live originally involved a sense of time. It is now used as a simple, but very effective, count to prevent routing errors and loops. Every router that handles the packet decrements the TTL value and if it reaches zero the packet is returned with a ICMP Time Exceeded message. A trace route comand (tracert) is usually a series of ping commands with increasing values of the TTL parameter such that the packet will be returned from each successive router. Called a hop limit in IPv6 to clarify its use.

ICMP Header

Internet Control Message Protocol (ICMP) is used to perform many network 'housekeeping' tasks. Each ICMP message has a slightly different format but the first 4 bytes are ALWAYS the same.

Notes:

1. Checksum is IP one's complement standard (RFCs 1141 and 1624).

ICMP Echo Request/Response (Ping)

In a ping operation the entire packet is echo'd (or pinged as in ping-pong) back to the sender. A trace route comand (tracert) is usually a series of ping commands with increasing values of the TTL parameter (in IP header) such that it will be returned from each successive router.

ICMP Unreachable

The code field specifies the type of error.

ICMP Source Quench

Great idea but most implementations seem to ignore this polite request to stop sending so much data.

ICMP Redirect

Indicates the host should use the specified gateway to reach the IP address contained in the returned message.

ICMP Time Exceeded

Message returned by the discovering router when the TTL count reaches 0 in the IP header or timeout problem with fragmentation.

UDP Header

UDP (User Datagram Protocol) is a connectionless protocol and represents a lightweight method of sending and receiving data.

Notes

1. UDP Checksum. If a UDP checksum is present (optional for IPv4, mandatory for IPv6) it is assumed to have a 'psuedo header' field of the following format prepended to the data:

   Octet	Len	Name	Notes
   0-3	4	Source	Source IP address
   4-7	4	Destination	Destination IP address
   8	1	Zero	Always zero
   9	1	Protocol	Always 17 for UDP
   10-11	2	Length	Length of UDP packet (excluding this psuedo header)

   The UDP checksum is computed by including the above 'pseudo header' plus the total UDP packet including the 'real' UDP header.

2. Checksum is IP one's complement standard (RFCs 1141 and 1624).

TCP Header

TCP (Transmission Control Protocol) is a connection-oriented protocol (it has opens and closes and stuff) and provides secure data transfer (the protocol includes ACKs and stuff). You can get the same level of service using UDP but you have to 'hand-carve' the opening, closing and ACK processes. TCP is incredibly efficient and its windowing mechanism especially provides very fast network performance adaptive feedback.

NOTES:

1. The TCP checksum is assumed to have a 'psuedo header' field of the following format prepended to the data:

   Octet	Len	Name	Notes
   0-3	4	Source	Source IP address
   4-7	4	Destination	Destination IP address
   8	1	Zero	Always zero
   9	1	Protocol	Always 6 for TCP
   10-11	2	Length	Length of TCP packet (excluding this psuedo header)

   The TCP checksum is computed by including the above pseudo header plus the total TCP packet including the real TCP header.

2. Checksum is IP one's complement standard (RFCs 1141 and 1624).

TCP Options

TCP allows a number of options sent with the SYN command. Option list MUST be padded with zeros (end of list option) to a multiple of 32 bits. Options may be one byte or multiple bytes (TLD format) in this case octet 2 is always the length value, octet 3+ contains data.

Currently defined options are (exhaustive list is here):