The IPv4 Datagram

The 20-byte fixed header field by field, plus the step-by-step process a router follows to move a datagram from source to destination.

The idea

Every device that touches a datagram — the sending host, every router along the way, the receiving host — needs the same three questions answered: where is this going, how big is it, and how should it be handled if something is wrong. The header is where those answers live.

Lecture 5 breaks the network layer’s job into three roles. At the source, a host builds the datagram, embeds the source and destination addresses, and checks its own table for where to send it next. At each router, the datagram is checked against a routing table to find the outgoing interface, and that information is used, not stored in the packet. At the destination, the address is verified, any fragments are held until the full set has arrived, and the payload is finally passed up to the transport layer.

The header carries everything those three roles need, and nothing more — IP itself makes no promises about delivery. It is connectionless and best-effort: if a datagram is lost, corrupted or misdelivered, the network layer does not notice and does not retry. That is why the header checksum below covers only the header, never the payload — checking data integrity is someone else’s job.

The header field by field

How it works

20 bytes fixed, plus options

Fixed part is 20 bytes — five 32-bit words. The three fragmentation fields (identification, flags, offset) sit together in the second word, which is worth remembering when a question asks you to fragment a datagram.

Field	Width	Width source	Purpose
Version	4 bits	RFC 791	IP protocol version number (4 for IPv4)
Header Length (HLEN)	4 bits	RFC 791	Header length in 4-byte words — multiply by 4 for the byte count
Type of Service	8 bits	RFC 791	Lets packets be treated differently based on application needs
Total Length	16 bits	RFC 791	Whole datagram length in bytes, header included
Identification	16 bits	RFC 791	Marks which fragments belong to the same original datagram
Flags	3 bits	RFC 791	Reserved bit; DF — 0 can fragment, 1 cannot; MF — 1 more fragments follow, 0 last or only
Fragmentation Offset	13 bits	Lecture 5	Position of this fragment within the original datagram, in 8-byte units
Time-to-Live	8 bits	RFC 791	Hop count remaining before the datagram is discarded
Protocol	8 bits	RFC 791	Upper-layer protocol carried, e.g. TCP or UDP
Header Checksum	16 bits	RFC 791	Error check over the header only, not the payload
Source Address	32 bits	RFC 791	Sender's 32-bit IP address
Destination Address	32 bits	RFC 791	Receiver's 32-bit IP address
Options + Padding	variable	RFC 791	Routing, timing and management extras — rarely used, padded to a 32-bit boundary

Lecture 5 states one width directly: the 13-bit fragment offset. The other twelve are RFC 791 §3.1 values — not something the slides give a number for, but independently verified to sum to exactly the 160 bits (20 bytes) the lecture does state as the fixed header size.

Three fields carry three different units, which is worth noticing before it trips you up: Total Length is bytes, HLEN is 4-byte words, and Fragmentation Offset is 8-byte units. Converting between them correctly is most of what fragmentation questions are actually testing — more in the next topic.

How a datagram finds its way

Every host and router keeps a forwarding table: destination network, next router (or a dash if it is directly attached), and hop count. Lecture 5 works through delivery using one small network — three subnets, 223.1.1.0, 223.1.2.0 and 223.1.3.0, joined by a single router with one interface on each. Host A sits on 223.1.1.0 with mask 255.255.255.0; host E sits on 223.1.2.0, reached through the router’s 223.1.2.9 interface, at address 223.1.2.2. The lecture never gives A or B’s own addresses, only their positions relative to the network — this page keeps that convention rather than inventing numbers the slides do not state.

Destination network	Next router	Hops
223.1.1.0	— (directly connected)	1
223.1.2.0	223.1.1.4	2
223.1.3.0	223.1.1.4	2

A's own forwarding table. A dash means the network needs no next hop — it is the one A itself sits on.

Destination network	Next router	Hops	Interface
223.1.1.0	— (directly connected)	1	223.1.1.4
223.1.2.0	— (directly connected)	1	223.1.2.9
223.1.3.0	— (directly connected)	1	223.1.3.27

The router's own table, once the datagram reaches it. Every network shows as one hop with a dash, because the router sits directly on all three.

Worked example

Same subnet — A delivers to B

A works out which network B belongs to. ANDing B’s address against the mask 255.255.255.0 gives the network to check.
That network matches A’s own — row one of A’s table above, hop count 1, no next router.
Because they share a subnet, there is no routing decision to make. The link layer sends the datagram directly to B, inside a link-layer frame — the network layer at any router is never involved.
This needs B’s MAC address, not another IP lookup. A already holds it in its MAC address table, found earlier via ARP.

AnswerNo router involved. The link layer frames it straight to B.

Worked example

Different subnet — A delivers to E

A works out which network E belongs to — the same first step as before.
This time the network does not match A’s own. E is not directly attached, so the link layer alone cannot reach it — a router is needed.
A checks its forwarding table. The entry for E’s network gives next-hop router 223.1.1.4 (row two of A’s table above).
The link layer sends the datagram to that router, inside a frame addressed to the router’s MAC address — not E’s. A does not need to know anything past the next hop.
The datagram arrives at the router, on its 223.1.1.4 interface.
The router repeats the same lookup A did: which network is E on?
This time it matches the router’s own 223.1.2.9 interface (row two of the router’s table above) — E is directly attached to the router.
From the router’s point of view this is now a same-subnet delivery. The link layer sends the datagram straight out interface 223.1.2.9, framed to E’s MAC address.
The datagram arrives at E, 223.1.2.2.

AnswerTwo hops: A to the router's 223.1.1.4 interface, then the router to E at 223.1.2.2 via 223.1.2.9

Where marks get lost

Same subnet means no router, ever

The cleanest trap in this example: if A and B AND to the same network, the datagram never touches a router’s network layer. It goes link-layer to link-layer, addressed by MAC, not IP-routed at all. A question describing two hosts “on the same LAN” or “same subnet” and then asking what a router does with the packet is testing whether you notice there isn’t one. Only reach for the forwarding table once the AND actually produces a different network.

Check yourself

Two to try without scrolling back up:

A holds a datagram for a host on network 223.1.3.0. Which row of its table applies, and how many hops?
Once the datagram reaches the router, does the router consult A’s table or its own?

Answers: (1) Row three — next router 223.1.1.4, 2 hops. (2) Its own. Nothing about A’s table travels with the datagram; every device that handles it looks itself up in its own forwarding table.

In the exam

Check for a router before doing anything else. AND the destination against the sender’s mask. Same network means no router, full stop.
Know both shapes of a forwarding-table entry. A host’s table lists a next-hop router for indirect networks; a router’s own table shows a dash and an interface for everything it is directly attached to.
Field widths: only fragment offset is the lecture’s own number. The rest are RFC 791 — safe to use, but say so if a question asks you to cite where a width comes from.
HLEN counts 4-byte words, not bytes. Multiply by 4 to get the header length in bytes; the minimum HLEN is 5, giving the 20-byte fixed header.
Total Length includes the header. It is the whole datagram in bytes, not just the payload — the distinction matters as soon as fragmentation is on the table.