Ethernet Frames
Ethernet Frames reside at the Data Link layer of the OSI 7 Layer model. They are the base network block of modern IP networks. As a system pulls the data off the physical wire the Ethernet Frame is the first layer that must be removed or decapsulated prior to reading the information.
Ethernet Frame
| 8 Bytes |
1 Byte |
6 Bytes |
6 Bytes |
4 Bytes |
2 Bytes |
9000 Bytes (Jumbo Frames) |
4 Bytes |
| Preamble |
SFD (Start Frame Delimeter) |
Destination Address |
Source Address |
VLAN TAG |
Type / Length |
DATA |
Frame Check Sequence (CRC) |
IPv4 and IPv6
Both IPv4 and IPv6 reside at the Network layer of the OSI 7 Layer model. They provide the addressing for systems to communicate outside the local subnet. Once a system has decapsulated the Ethernet Frame the system evaluates the IP information presented. IPv4 was created in 1981 as part of IETF RFC 791 but was first deployed in 1983. However as the internet grew it became apparent that public IPv4 space would be fully consumed which prompted the creation of IPv6. IPv4 address space was officially depleted on September 24th 2015. As such IPv6 is now all that can be purchased from ARIN which is the American Registry of Internet Numbers. IANA is the Global organizer of Internet Address space and there are other regions.
IPv4 Header
| IPv4 Header (32 bits) |
| Starting Byte |
Byte |
Byte |
Byte |
Byte |
|
0 |
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
25 |
26 |
27 |
28 |
29 |
30 |
31 |
| 0 |
Version |
IHL (header Len) |
Type Of Server (TOS) |
Total Length |
| 4 |
Identification |
IP Flag |
Fragment Offset |
| 8 |
Time To Line (TTL) |
Protocol |
Header Checksum |
| 12 |
Source Address |
| 16 |
Destination Address |
| 20 |
IP Option (Variable Length, Optional, not common) |
IPv6 Header
| IPv6 Header (128 bits) |
| Starting Byte |
Byte |
Byte |
Byte |
Byte |
|
0 |
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
25 |
26 |
27 |
28 |
29 |
30 |
31 |
| 0 |
Version |
Traffic Class |
Flow Label |
| 4 |
Payload Length |
Next Header |
Hop Limit |
| 8-20 |
Source Address |
| 24 - 36 |
Destination Address |
TCP Header
TCP is one of the final encapsulation layer before it enters the operating system. Servers will typically listen on a specific port for a protocol to function. For example an unencrypted web server typically listens on TCP port 80.
| TCP Header (60 Bytes) |
| Starting Byte |
Byte |
Byte |
Byte |
Byte |
|
0 |
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
25 |
26 |
27 |
28 |
29 |
30 |
31 |
| 0 |
Source Port # (16 bits) |
Destination Port # (16 bits) |
| 4/td>
|
Sequence Number (32 bits) |
| 8 |
Acknowledgement Number (32 bits) |
| 12 |
Header Length (4) |
Reserved (6) |
URG |
ACK |
PSH |
RST |
SYN |
FIN |
Window Size (16 bits) |
| 16 |
TCP Checksum (16 bits) |
Urgent Pointer (16 bit) |
| 20 |
Options (if any, variable length, padded with 0's) |
| 24 |
Actual Data Payload |
UDP Header
UDP is at the same level as TCP in that its also one of the final encapsulation layer before it enters the operating system. Servers will typically listen on a specific port for a protocol to function. For example a DHCP server will listed on UDP port 67 and 68 for a DHCP request.
| UDP Header (8 Bytes) |
| Starting Byte |
Byte |
Byte |
Byte |
Byte |
|
0 |
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
25 |
26 |
27 |
28 |
29 |
30 |
31 |
| 0 |
Source Port # (16 bits) |
Destination Port # (16 bits) |
| 4 |
Length (16 bits) |
Checksum (16 bits) |
ICMP Header
ICMP is at the same level as TCP and UDP but is used for network control with ARP and ping.
| ICMP Header (8 Bytes) |
| Starting Byte |
Byte |
Byte |
Byte |
Byte |
|
0 |
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
25 |
26 |
27 |
28 |
29 |
30 |
31 |
| 0 |
Type (8 bits) |
Code (8 bits) |
Checksum (16 bits) |
| 4 |
Other Message Specific Information (32 bits) |
IGMP Header
IGMP is at the same level as TCP and UDP and ICMP but is used for multicast communications. The following is the IGMPv1 header
IGMP Header Version 1
| IGMP Header Version1 (8 Bytes) |
| Starting Byte |
Byte |
Byte |
Byte |
Byte |
|
0 |
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
25 |
26 |
27 |
28 |
29 |
30 |
31 |
| 0 |
Version (4 bits) |
Type (4 bits) |
Unused (8 bits) |
Checksum (16 bits) |
| 4 |
Group Address (32 bits) |
IGMP Header Version 2
| IGMP Header Version2 (8 Bytes) |
| Starting Byte |
Byte |
Byte |
Byte |
Byte |
|
0 |
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
25 |
26 |
27 |
28 |
29 |
30 |
31 |
| 0 |
Type (8 bits) |
Max Response Time (8 bits) |
Checksum (16 bits) |
| 4 |
Group Address (32 bits) |
Internet Protocol Security (IPSEC) Header
IPSEC is a security protocol suite built for IP communications. Each packet is authenticated and encrypted prior to transmission.
IPSEC Authentication Header
| IPSEC Authentication Header(12 Bytes) |
| Starting Byte |
Byte |
Byte |
Byte |
Byte |
|
0 |
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
25 |
26 |
27 |
28 |
29 |
30 |
31 |
| 0 |
Next Header (8 bits) |
Payload Length (8 bits) |
Reserved (16 bits) |
| 4 |
Security Parameters Index (SPI) (32 bits) |
| 8 |
Sequence Number (32 bits) |
| 16 |
Integrity Check Value (ICV) (32 bits or more as required) |
IPSEC ESP Header
| IPSEC Encapsulating Security Payload (ESP) Header |
| Starting Byte |
Byte |
Byte |
Byte |
Byte |
|
0 |
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
25 |
26 |
27 |
28 |
29 |
30 |
31 |
| 0 |
Security Parameter Index (SPI) (32 bits) |
| 4 |
Sequence Number (32 bits) |
| 8 |
Payload Data (32 bits or more) |
| ... |
Padding (0 - 255 Bytes) |
| ... |
Padding Length (8 Bytes) |
Next Header (8 Bytes) |
Integrity Check Value (ICV) (4 bytes or more) |
Generic Routing Encapsulation (GRE) Header
GRE is a tunneling protocol that encapsulates other data. Once the Data is encapsulated the traffic will appear to an end user to be a point to point link even though there may be several routed connections the tunnel traverses. It can be useful to transfer one type of network, such as guest traffic, over another network, such as a corporate network, if encryption is not required.
| Generic Routing Encapsulation Header(16 Bytes) |
| Starting Byte |
Byte |
Byte |
Byte |
Byte |
|
0 |
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
25 |
26 |
27 |
28 |
29 |
30 |
31 |
| 0 |
Checksum Present (1 bits) |
Reserved (12 bits) |
Version Number (3 bits) |
Protocol Type (16 bits) |
| 4 |
Checksum (optional) (16 bits) |
Reserved (optional) (16 bits) |
Generic Routing Encapsulation (GRE) Header - Extended
In September of 2000 the IETF in RFC 2890 added extensions to the GRE header.
| Generic Routing Encapsulation Header(32 Bytes) |
| Starting Byte |
Byte |
Byte |
Byte |
Byte |
|
0 |
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
25 |
26 |
27 |
28 |
29 |
30 |
31 |
| 0 |
Checksum Present (1 bits) |
Key Present (1 bits) |
Sequence Number Present (1 bits) |
Reserved (12 bits) |
Version Number (3 bits) |
Protocol Type (16 bits) |
| 4 |
Checksum (optional) (16 bits) |
Reserved (optional) (16 bits) |
| 8 |
Key (optional) (32 bits) |
| 12 |
Sequence Number (optional) (32 bits) |
OSI 7 Layer Model
As this article referances the OSI 7 Layer model its being included as a referance Application
Presentation
Session
Transport
Network
Data Link
Physical