Where Does the IP Stop and the Embedded Protocol Begin?

We just learned how to determine what embedded protocol follows the IP header—a very significant step in doing packet dissection. The next problem we encounter is knowing where headers stop and other parts of the packet begin. A normal IP header with no IP options such as source routing has a length of 20 bytes. An IP header greater than 20 bytes long should contain IP options. The IP header length is found in the 0 byte offset of the IP header in the low-order nibble. This is the hex character that follows the IP version number. But, we find a value of 5 there. How does that relate to a normal 20-byte header? The IP header length is expressed in 32-bit words, meaning that any value found in this field must be multiplied by 4.

Although it would be nice and a whole lot less complicated if all the many lengths fields found in the packet were expressed in bytes, this just isn't the case. You might be thinking (or cursing to yourself), why couldn't the wise creators of TCP/IP have been more merciful and standardized on bytes? The most likely reason is that when TCP/IP was created years ago, hardware and software were much slower and it took longer to send more data, even a couple of bits. The thought was that if bits could be compressed, they could be processed or sent more quickly. So there is some rhyme and reason to what you might perceive as random mayhem.

Now that we know that we have a 20-byte IP header, we count 20 bytes into the hex data that we find in previous hex output. When we deal with length bytes, we have a total of 20 bytes. We aren't concerned about offsets, so we don't need to start counting at 0. We simply count off a number of total bytes, in this case 20. We have 16 bytes in the first row of hex output and need only to count off 4 more in the second row to take us to where the IP header stops and the ICMP header begins in this packet. The ICMP header begins with the first two bytes of 0800.

Other Length Fields

Let's look at some other length fields in the IP packet. Ultimately, we need to know how to

interpret these values to be able to decode the packet.

The IP Datagram Length

Another very important field is the IP packet total length. Fortunately, this is expressed in bytes so we don't have to manipulate it in any way. This field is found in the second and third bytes offset of the IP header. The only tricky part is computing this from hex to decimal.

Converting Hex to Decimal

Taking hex output and converting it to decimal might not be intuitive, so we need a review. Any time you need to convert hex to decimal for a field, do the following:

1.Figure out how many hex characters are in the field by examining the protocol layout.

2.Start at the rightmost hex character.

3.Represent each hex character in the field as an increasing power of 16 beginning with an exponent of 0.

4.Multiply each base by exponent and add all individual products.

For instance, in the previous example, we find the value of 0054 in the IP datagram total length. Going step by step to translate it to decimal:

1.The IP datagram length is 16 bits.

2.This is 4 hex characters of output.

3.Start at the rightmost hex character (4).