Protocol Header Cheatsheets

A set of cheatsheets for Ethernet, IPv4, UDP, TCP and ICMP protocol headers.

• Ethernet Frame Header
• IPv4 Protocol Header
• TCP Protocol Header
• UDP Protocol Header
• ICMP Protocol Header
• A3 Wall Poster
• Source code and licence

Ethernet Frame Header

Notes

• An ethernet frame has a minimum size of 64 bytes and a maximum size of 1,518 bytes.
• Any frames smaller than the 64 byte minimum is interpreted by receivers as a collision. The Ethernet frame payload may not exceed 1,500 bytes.
• The minimum payload size is 42 bytes when an 802.1q tag is present, or 46 bytes if 802.1q tags are not used.
• The Maximum Transmission Unit (MTU) value governs the size of the payload, and nearly all IP over Ethernet implementations use Ethernet V2, which specifies an MTU value of 1,500.
• When the payload is not large enough to produce a frame of 64 bytes in length, padding is added accordingly.
• Some components of the frame at OSI Layer 1 are usually stripped by hardware adapters, do not count towards the frame size, and are not usually visible to packet sniffing software. Almost no ethernet adapters supply the preamble and SFD. Some adapters may supply the CRC/FCS. Wireshark attempts to guess whether an Ethernet packet has an FCS and, if it thinks it does, handles it as such. See here for more information.
• Any Ethernet frame less than 64 bytes on the wire is considered by the receiving station to be a “collision fragment” or “runt frame”, and is automatically discarded. Note that frames smaller than 64 bytes do not cause collisions, but are just interpreted as such.
• Preamble and Start of frame delimiter (SFD) See https://en.wikipedia.org/wiki/Ethernet_frame
• Frame check sequence (32‑bit CRC) See https://en.wikipedia.org/wiki/Frame_check_sequence
• Interpacket gap See https://en.wikipedia.org/wiki/Interpacket_gap and https://serverfault.com/questions/422158/
• The Preamble, SFD and Interframe Gap do not count as part of the frame. They are support structure for the Ethernet protocol itself.
• 802.1q tag is composed of four smaller fields: Tag protocol identifier (TPID, 16 bits), Priority code point (PCP, 3 bits), Drop eligible indicator flag (DEI, 1 bit, formerly CFI), VLAN identifier (VID, 12 bits). Ignoring VXLAN, This is why network devices do not carry more than 4,096 vlans (2^12). See here for more information.

Summary

IPv4 Header

Notes

• The Internet Protocol (IPv4) is defined in RFC 791 which specifies the format of the header.
• IHL (Internet Header Length) is 4 bits long and specifies the header length in increments of 32 bits (DWORD). The IHL field can hold values from 0 (Binary 0000) to 15 (Binary 1111). So the longest the IP header size can be is up to 480 bits, which is 60 bytes. The shortest header size is 5 dwords (20 bytes), where the IHL field has the value of 5 (Binary 0101). This is because all of the required fields in the header require 20 bytes as a minimum.
• The Type of Service (ToS) field is obsoleted by RFC 2474 (updated by RFC 3168 and RFC 3260) is used for Differentiated Services Code Point (DSCP) and Explicit Congestion Notification (ECN).
• The Flags field is composed of 3 smaller fields: Reserved (must be 0), Don’t fragment bit (DF) and More fragments bit (MF).

Summary

TCP Header

Notes

Summary

UDP Header

Notes

A UDP datagram is carried in a single IP packet and is hence limited to a maximum payload of 65,507 bytes for IPv4 and 65,527 bytes for IPv6.

Summary

ICMP Header

Notes

Summary

Protocol Frames Cheatsheet - A3 Wall Poster

Source code and licence

Original drawings and source at https://github.com/pingfu/ethernet-cheatsheet. Content licensed under CC-BY 3.0, code licensed under MIT. Diagrams created using the excellent https://www.draw.io/

comments powered by Disqus