1. Decoding an IP Header (1)
0x45 =
Version 4, IHL 5
0x00 =
ToS 0 (not set)
c9e d06 178c d823 d9ba
ac10 00b f5 729a c db4f
d0 a7cb b4 6c73 202d 6c
IP Version
Length: 4 bits
Offset: 0 bits
IP Header Length (IHL)
Length: 4 bits
Offset: 4 bits
Type of Service (ToS)
Length: 1 byte
Offset: 1 byte

2. Decoding an IP Header (2)
0x0034 =
Length 52 bytes
0xc9e7 =
IPID 51687
0x3d =
TTL 61
c9e d06 178c d823 d9ba
ac10 00b f5 729a c db4f
d0 a7cb b4 6c73 202d 6c
Total Packet Length
Length: 2 bytes
Offset: 2 bytes
IP Identification (IPID)
Length: 2 bytes
Offset: 4 bytes
Time to Live (TTL)
Length: 1 byte
Offset: 8 bytes

3. Decoding an IP Header (3)
0x4000 = Flags 010 (Don’t Fragment set) Fragment Offset = 0’s (not set)
0x06 =
Embedded Protocol 6 (TCP)
c9e d06 178c d823 d9ba
ac10 00b f5 729a c db4f
d0 a7cb b4 6c73 202d 6c
IP Header Flags
Length: 3 bits
Offset: 6 bytes
Fragment Offset
Length: 13 bits
Offset: 6 bytes + 3 bits
Embedded Protocol
Length: 1 byte
Offset: 9 bytes

4. Decoding an IP Header (4)
0xd8 0x23 0xd9 0xba =
Source Address
0x178c =
Checksum 62216
0xac 0x10 0x00 0xb7 =
Destination Address
c9e d06 178c d823 d9ba
ac10 00b f5 729a c db4f
d0 a7cb b4 6c73 202d 6c
Checksum
Length: 2 bytes
Offset: 10 bytes
Source Address
Length: 4 bytes
Offset: 12 bytes
Destination Address
Length: 4 bytes
Offset: 16 bytes

5. Decoding a TCP Header (1)
0x0017 =
Source Port 23
0x12f5 =
Dest. Port 4853
0x729a2105 =
Sequence number
c9e d06 178c d823 d9ba
ac10 00b f5 729a c db4f
d0 a7cb b4 6c73 202d 6c
Source Port
Length: 2 bytes
Offset: 0 bytes
Destination Port
Length: 2 bytes
Offset: 2 bytes
Sequence Number
Length: 4 bytes
Offset: 4 bytes

6. Decoding a TCP Header (2)
0x60 =
Header Len 0110 = 6
0xa7cb =
Checksum 42955
0x145cdb4f =
ACK number
0x18 =
Flags = PSH, ACK
c9e d06 178c d823 d9ba
ac10 00b f5 729a c db4f
d0 a7cb b4 6c73 202d 6c
ACK Number
Length: 4 bytes
Offset: 8 bytes
Header Length Length: 4 bits
Offset: 12 bytes
TCP Flags
Length: 1 byte
Offset: 13 bytes
Checksum
Length: 2 bytes
Offset: 16

7. Decoding a TCP Header (3)
0x16d0 =
Window size 5840
0x0000 =
Urgent Ptr 0 (not set)
0x020405b4 =
0x02 MSS set, 0x04 4 bytes
0x05b4 MSS is 1460 bytes
c9e d06 178c d823 d9ba
ac10 00b f5 729a c db4f
d0 a7cb b4 6c73 202d 6c
TCP Window Size
Length: 2 bytes
Offset: 14 bytes
Urgent Ptr
Length: 2 bytes
Offset: 18 bytes
TCP Options
Length: variable
Offset: 20 bytes
Data
Length: variable
Offset: variable

8. Decoding a TCP Header (4)
(TCP Header Length - Min. TCP Header Length) = TCP Options Length
(6 * 4) =
IP Total Length - (IHL + TCP Header Length) = Payload Length
((5 * 4) + (6 * 4)) =
c9e d06 178c d823 d9ba
ac10 00b f5 729a c db4f
d0 a7cb b4 6c73 202d 6c
TCP Options
Length: 4 bytes
Offset: 20 bytes
0x020405b4 =
0x02 MSS set, 0x04 4 bytes
0x05b4 MSS is 1460 bytes
Payload
Length: 8
Offset: 24 bytes