Packets:

Packets are data-turduckens: [ Ethernet frame [ IP packet [ TCP packet [misc data] ] ] ]

Ethernet frames:

• Bytes/values transmitted least significant bit first.
• Composed of the following:

  Octets    Structure:
  ------------------------
  7     Preamble (0x55 * 7)
  1     Start of frame delimiter (0xD5)
  6     MAC destination
  6     MAC source
  (4)       802.1Q tag (optional) used for tagging Ethernet frames for
          Virtual LANs
  2     Ethertype - Indicates what protocol is encapsulated in the
          Ethernet frame(Ethernet II) or length (IEEE 802.3)
  46(42)-1500*  Payload
  4     Frame check sequence (32-bit CRC)
  12        Inter-packet gap

Internet Protocol (IP) (man 7 ip)

• Provides a routable protocol for delivering data-gram packets across networks based on IP address.
• Packets routed based on destination.

IPv4 packet header:

Offsets    |0               1               2               3
Octet Bit  |0 1 2 3 4 5 6 7 8 9 10111213141516171819202122232425262728293031
0     0    |Version |IHL    |DSCP       |ECN|         Total Length
4     32   |     Identification             |Flags|    Fragment Offset
8     64   |Time To Live    |Protocol       |        Header Checksum
12    96   |Source IP Address
16    128  |Destination IP Address
20+   160  |Options (if IHL > 5)

IPv4 cont:

Version (4 bits)

• For IPv4 this is 4 IHL (Internet Header Length) (4 bits)
• The # of 32 bit words in the header. Encodes the offset to the data. DSCP (Differentiated Services Code Point) (6 bits)
• Originally the Type of Service (ToS) field. Used to classify the kind of packet this is for real-time application and the like, to be used with Layer 3 switches for traffic prioritization and quality of service (QoS). ECN (Explicit Congestion Notification) (2 bits)
• Allows end to end notification of network congestion (when supported) w/o dropping packets which is normally done. The sender should reduce the rate of transmission (as if packets were being dropped) when the receiver indicates that there will be congestion.

Total Length (16 bits)

• Encodes the size of the entire IP packet in bytes, including header and data. Identification (16 bits)
• Used to uniquely identify a fragment of a single data-gram. Flags (3 bits)
• Bitfield used to control or identify fragments: Bit 0 - reserved, must be 0. Bit 1 - Do not fragment (DF) Bit 2 - More fragments (MF) Fragment Offset (13 bits)
• offset (in 8 byte blocks) within the original un-fragmented IP packet. TTL (Time to Live) (8 bits)
• Limits the packets lifetime to prevent it from going in circles forever. Specified in seconds, it has become a de-facto "hop-count", being decremented at each router the packet passes through. Protocol (8 bits)
• Defines the IP protocol in use, defined by the IANA: (/etc/protocols) 1 = ICMP, 6 = TCP, 17 = UDP, etc. Header Checksum (16 bits)
• Checksum for the header. If the checksum does not match the computed value for the packet, it is discarded. A router that modifies the TTL must generate a new checksum for the packet before passing it along. Source Address (32 bits)
• IPv4 address for the sender of the packet. Destination address (32 bits)
• IPv4 address for the receiver of the packet. Options (32+ bits)
• Not often used.

UDP packet header:

[Source port (2 octets)][Destination port (2 octets)] [Length (2 octets)][Checksum (2 octets)] [ Data (length-8 octets) .... ]

• Source Port - Port to reply to if needed, may be zero.
• Destination Port - Port to send to.
• Length - Total length, including the header (8 octets) (64K max)
• Checksum - Not required (all 0's) for IPv4, required for IPv6.

Transmission Control Protocol (TCP) (man 7 tcp)

• https://en.wikipedia.org/wiki/Transmission_Control_Protocol

• Provides reliable, ordered delivery of a data stream. If a packet fails to arrive at its destination it will eventually be resent.

• Header contains among other information:

  • Source and destination ports (16 bits each)
  • Sequence & Acknowledgment numbers

TCP packet header:

[ Source Port (2 octets) ][ Destination Port (2 octets) ] [ Sequence number (4 octets) ] [ Acknowledgment number (4 octets) ] [ Data Offset (4bits)][Reserved(3bits)][Flags(9bits)][Window Size (2octets)] [ Checksum (2 octets) ][ Urgent pointer(if URG set)(2) ] [ Options (if data offset > 5). Zero padded if necessary ] [ Data ... ]

Flags = { NS | CWR | ECE | URG | ACK | PSH | RST | SYN | FIN } (1 bit each)

• Src/Dst ports - same as UDP.

• Sequence #

  • If SYN is 1: The initial sequence number. Seq# of first data byte and the Acknowledgment # of the ACK response are this + 1.
  • If SYN is 0: Accumulated sequence number of first data byte of this segment for the current session.

• Acknowledgment #

  • Next expected sequence # if ACK is set. Acknowledges receipt of all prior bytes. First ACK's acknowledge each ends initial sequence #.

• Reserved (3 bits)

• Flags (9 bits): NS ECN (Explicit Congestion Notification)-nonce concealment protection. CWR Congestion Window Reduced. ENE ECN - Echo URG Indicates that the Urgent Pointer field is to be used. ACK Indicates the Acknowledgment field is to be used. PSH Push Function RST Reset connection SYN Synchronize sequence numbers (set when initializing connection) FIN No more data from sender

• Window Size (16 bits)

  • Size of the receive window (in window size units (bytes)) that the receiver is currently willing to receive.

• Urgent Pointer

• If URG is set, indicates the offset from the sequence # of the last urgent data byte.

• Options

  • Zero padded to 32 bit boundaries.