0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Destination Address
Destination Address (cont.)
Source Address
Source Address (cont.)
Ethertype
Ethertype
0x0800
0x0806
0x0842
0x8035
0x814c
0x86dd
Keyword
IPv4
ARP
WoL
RARP
SNMP
IPv6
Table 1: Ethertypes
Figure 1: Ethernet Header
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
IHL
Total Length
TOS
RES
DF
MF
Version
Identification
TTL
Protocol
Protocol
Internet Protocol, Version 4
Address Resolution Protocol
Wake-on-LAN Magic Packet
Reverse Address Resolution Protocol
Simple Network Management Protocol
Internet Protocol, Version 6
Fragment Offset
Header Checksum
Source Address
Destination Address
Options / Padding (optional)
Figure 2: IPv4 Header
Protocol / Next
Header
0x01
0x02
0x04
0x06
0x09
0x0a
0x11
0x21
0x2f
0x32
0x84
Keyword
Protocol
ICMP
IGMP
IPv4
TCP
EGP
IGP
UDP
IPv6
GRE
ESP
SCTP
Internet Control Message
Interet Group Management
IPv4 encapsulation
Transmission Control
Exterior Gateway Protocol
any private interor gateway protocol
User Datagram
IPv6 encapsulation
General Routing Encapsulation
Encapsulating Security Payload
Stream Control Transmission
Table 2: IP Protocol Numbers
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Version
Traffic Class
Flow Label
Payload Length
Hop Limit
Next Header
Source Address
Destination Address
Port Number
22
23
25
53
67
68
80
110
443
546
547
Service Name
ssh
telnet
smtp
domain
bootps
bootpc
http
pop3
https
dhcpv6-client
dhcpv6-server
Description
The Secure Shell (SSH) Protocol
Telnet
Simple Mail Transfer
Domain Name Server
Bootstrap Protocol Server (DHCP)
Bootstrap Protocol Client (DHCP)
World Wide Web HTTP
Post Office Protocol - Version 3
http over TLS/SSL
DHCPv6 Client
DHCPv6 Server
Table 3: Well Known Port Numbers
Figure 3: IPv6 Header
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Source Port
Type
0 –- Echo Reply
1 and 2
Code
0
Destination Port
Sequence Number
FIN
SYN
PSH
Reserved
RST
URG
Offset
ACK
Acknowledgement Number
Window
Urgent Pointer
Checksum
3 – Desintation Unreachable
Options (0 or more multiples of 4 byte)
Figure 4: TCP Header
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Source Port
Destination Port
Length
Checksum
Figure 5: UDP Header
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Type
Code
4 – Source Quench
5 – Redirect Message
6
7
8 – Echo Request
9 – Router Advertisement
10 – Router Solicitation
Checksum
11 – Time Exceeded
Sequence Number
Identifier
Data (0 or more bytes)
12 – Parameter Problem
Figure 6: ICMP Echo Request/Reply
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Type
Code
Checksum
unused
IP Header + first 8 byte of original data datagram
Figure 7: ICMP Destination unreachable
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Type
Code
Checksum
unused
IP Header + first 8 byte of original data datagram
Figure 8: ICMP TTL Exceeded
13
14
15
16
17
18
19
30
31
32
33
34
35
36
37
38
39
40
41
42
–
–
–
–
–
–
–
Timestamp
Timestamp Reply
Information Request
Information Reply
Address Mask Request
Address Mask Reply
29
Traceroute
- 255
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
0
0
1
2
3
0
0
0
0
1
0
1
2
0
0
0
0
0
0
0
Description
Echo reply
Reserved
Destination network unreachable
Destination host unreachable
Destination protocol unreachable
Destination port unreachable
Fragmentation required, and DF flag set
Source route failed
Destination network unknown
Destination host unknown
Source host isolated
Network administratively prohibited
Host administratively prohibited
Network unreachable for TOS
Host unreachable for TOS
Communication administratively prohibited
Host Precedence Violation
Precedence cutoff in effect
Source quench (congestion control)
Redirect Datagram for the Network
Redirect Datagram for the Host
Redirect Datagram for the TOS & network
Redirect Datagram for the TOS & host
Alternate Host Address
Reserved
Echo request
Router advertisement
Router discovery/selection/solicitation
TTL expired in transit
Fragment Reassembly Time Exceeded
Pointer indicates the error
Missing a required option
Bad length
Timestamp
Timestamp reply
Information request
Information reply
Address Mask Request
Address Mask Reply
Reserved
Information Request
Datagram Conversion Error
Mobile Host Redirect
Where-Are-You (originally meant for IPv6)
Here-I-Am (originally meant for IPv6)
Mobile Registration Request
Mobile Registration Reply
Domain Name Request
Domain Name Reply
SKIP Algorithm Discovery Protocol
Photuris, Security failures
ICMP for experimental mobility protocols
Reseved
Table 4: ICMP Types/Codes