IPv4
Internet Protocol version 4 · Network layer
IP is what makes the internet one network rather than millions of separate ones. It gives every machine an address that can be organised into blocks, so routers can forward towards a destination without knowing where every machine is. It is deliberately unreliable — packets may be lost, duplicated, or arrive out of order, and IP will not tell anyone.
Understand these first
- Why does this protocol exist?
- Ethernet can move a frame across one wire. Nothing in it can move data between two networks that have never heard of each other. IP is the layer that makes millions of separate networks behave as one.
- Which problem does it solve?
- Deliver a packet to a machine I have no direct connection to, through routers that have never heard of either of us, without anyone holding a list of every machine on Earth.
- Who participates?
- Every host and every router on the path. Hosts originate and consume; routers only forward, and are not addressed by the packet they carry.
- Which layer uses it?
- Network layer — layer 3. Carried in Ethernet with EtherType 0x0800.
- What does it depend on?
- A link layer to cross each hop, and ARP to find the MAC of each next hop.
- What depends on it?
- TCP, UDP, ICMP, OSPF — everything above the link layer. The whole rest of this curriculum sits on it.
- What state does each participant maintain?
- None per packet: IP is stateless, and that is the point. Routers hold a routing table, which is state about the network rather than about any conversation. Reassembly of fragments is the one exception, and it is per-packet and short-lived.
- Which fields matter?
- src / dst — The endpoints. Unlike the MAC addresses beside them, these do not change at any hop.
- ttl — Decremented by every router; the packet dies at zero. It is what stops a routing loop from lasting forever, and what traceroute exploits deliberately.
- protocol — Says what the payload is — 6 TCP, 17 UDP, 1 ICMP, 89 OSPF. Without it the receiver could not demultiplex.
- checksum — Covers the header only, and must be recomputed at every hop because TTL changed.
- identification / flags / fragmentOffset — Fragmentation. Only meaningful together, and only when a packet is too big for the next link.
- What does normal behaviour look like?
- A packet crosses several routers. Its source and destination IP never change; its TTL falls by one each hop; its Ethernet source and destination are rewritten completely at every hop.
- What does failure look like?
- No route to the destination and the packet is dropped, usually with an ICMP destination unreachable. Or TTL reaching zero, giving ICMP time exceeded. Or silent loss with nothing reported at all — IP does not promise to tell anyone.
- How can I prove the diagnosis from packets?
- Follow one packet hop by hop. If TTL is falling but the packet is not progressing, it is looping. If it stops at one router, look at that router's routing table for the destination prefix. The forwarding decision events name the rejected candidates.
- How does it interact with the rest of the stack?
- IP asks ARP for each next hop's MAC, carries TCP/UDP/OSPF, and reports its problems through ICMP. It promises nothing about delivery, order, or duplication, which is precisely why TCP exists.
Guided course — 5 lessons
Read in order. Every lesson pauses the capture on the packets it is talking about, and every one reads at three levels — so the time below is an estimate from the number of steps, not a measurement of anybody.
- 1IPv4-01The IPv4 Header, Field by FieldTwenty bytes, and two of them change at every hop≈15 min · 8 steps · 3 questions · guidedNot started
- 2IPv4-02How a Packet Crosses a RouterWhat changes at every hop, and what must never change≈10 min · 8 steps · 4 questions · guidedNot started
- 3IPv4-03When a Packet Is Too BigFragmentation, Don't Fragment, and the failure that only affects large transfers≈10 min · 7 steps · 3 questions · guided · after ipv4-forwardingNot started
- 4IPv4-04How a Route Gets Into the TableTwo protocols, one destination, and the rule that decides≈15 min · 9 steps · 4 questions · guided · after ipv4-forwardingNot started
- 5IPv4-05Addresses, Masks and SubnetsThe arithmetic every other decision in this course depends on≈10 min · 7 steps · 3 questions · guided · after ipv4-header-anatomyNot started
Packet explorer — 14 scenarios, no coaching
Two hosts on the same wire exchange a datagram. The TTL never decrements because nothing forwards it — a useful baseline before anything gets routed.
Delivery across a routerA datagram crosses one router. Watch the TTL fall by one, the header checksum change with it, and both MAC addresses get rewritten while the IP addresses stay put.
Longest-prefix matchR1 has a default route pointing one way and a /24 pointing another. Both match the destination. Watch the lookup pick the more specific one — and see why configuration order is irrelevant.
TTL across two routersTwo routers, two decrements. Select the same datagram at each stage and watch the TTL fall 64 → 63 → 62. Every hop leaves a fingerprint.
TTL expiry stops a packet deadThe same two-hop path, but the sender sets TTL to 1. The first router discards the packet and reports it — the mechanism that stops a routing loop circulating forever.
Fragmentation across a small linkA 1200-byte datagram meets a link with a 620-byte MTU. It is cut into pieces that each carry the same identification and their own offset — then rebuilt at the far end.
Don't Fragment: the packet is refused insteadIdentical to the fragmentation scenario except the Don't Fragment bit is set. The router cannot split it and will not forward it, so it drops the packet and reports the MTU it could have used.
Troubleshooting: no default routePC1 has an address and a mask but no gateway. Nothing is transmitted at all — the failure happens inside the host, before any packet exists.
Two paths to the same placeR1 can reach the branch through R2 or through R3, and both routes arrive by OSPF. With the trust level tied, the cost decides. Open the RIB: the losing route is still there, waiting.
The worse route winsOSPF offers a cost-20 route. An operator then adds a static route with a metric of 500 — twenty-five times worse — and the static route is installed instead. Read the rejection reason on the OSPF route.
A backup route that waitsA static route configured with distance 200 — worse than OSPF on purpose. It sits in the RIB doing nothing until the OSPF route disappears, then takes over instantly. Nobody advertises anything at that moment.
Specific beats trustedA static 10.0.0.0/16 and an OSPF 10.0.40.0/24 both cover the branch server. The OSPF route wins the packet despite being trusted far less — because the two were never in the same competition. Compare the RIB with the forwarding decision.
When the last link failsThe branch LAN is directly connected to R4. Its interface goes down mid-capture, and the connected route is withdrawn — a connected route is only a fact while the wire is up. Watch where the second ping dies.
No route, and no defaultNothing has advertised the branch prefix and R1 has no default route. Open the forwarding decision: every candidate is listed with the reason it does not match. This is what a routing black hole looks like from inside.
Move the prefix and watch the boundary move through the bits. Every forwarding decision on the internet starts with this comparison, and it is the one thing here that never appears in a capture.
Reference material
The terms this module introduces, and the specifications behind them. Both lists come from the lessons themselves rather than from a list kept beside them.
That you can perform a forwarding decision by hand and say what IP does and does not promise.
Where IPv4 sits in a real request
These captures run IPv4 as one stage of a longer chain, and hand its result to whatever comes next.