Ultimate IPv4 Cheat Sheet

IPv4 Address Structure

An IPv4 address is a 32-bit number, typically represented in decimal format with four octets (groups of 8 bits) separated by periods. Each octet can range from 0 to 255.

The first octet of an IPv4 address determines the address class. The three address classes are:

ipv4 Header

The IPv4 header is a fundamental component of the IPv4 protocol. It is a fixed-length, 20-byte (160-bit) header that contains essential information about the packet’s source, destination, and how it should be handled by routers during its journey across a network. Below is a breakdown of the IPv4 header fields:

 0   1   2   3   4   5   6   7   8   9  10  11  12  13  14  15
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version|  IHL  |Type of Service|         Total Length        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|         Identification        |Flags|    Fragment Offset    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  Time to Live |    Protocol   |        Header Checksum      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                         Source Address                      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                      Destination Address                     |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Options and Padding                       |
+---------------------------------------------------------------+
|                       Data (Payload)                         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

• Version (4 bits): Indicates the IP version being used. For IPv4, this field will always have a value of 4.
• IHL (Internet Header Length, 4 bits): Specifies the length of the header in 32-bit words (including any options). This field is important for parsing variable-length options.
• Type of Service (8 bits): Originally designed for specifying quality of service preferences, this field has been largely redefined in terms of Differentiated Services Code Point (DSCP) and Explicit Congestion Notification (ECN).
• Total Length (16 bits): Indicates the total length of the IPv4 packet (including both header and payload) in bytes.
• Identification (16 bits): Helps in identifying fragments of a larger packet when IP fragmentation is used.
• Flags (3 bits): Contains flags used for controlling the fragmentation process. These include the More Fragments (MF) flag and the Don’t Fragment (DF) flag.
• Fragment Offset (13 bits): Specifies the position of the fragment within the original unfragmented packet.
• Time to Live (8 bits): Represents the maximum number of hops a packet is allowed to take before it’s discarded by a router. This field helps prevent packets from looping infinitely.
• Protocol (8 bits): Identifies the protocol that is being used in the payload of the packet (e.g., TCP, UDP, ICMP).
• Header Checksum (16 bits): Provides error-checking for the header.
• Source Address (32 bits): Contains the IP address of the sender.
• Destination Address (32 bits): Contains the IP address of the intended recipient.
• Options and Padding: This field is optional and is used for various purposes, including timestamping and security.
• Data (Payload): This is where the actual data (e.g., TCP or UDP segments) resides. The length of this field is variable.

Keep in mind that some of the fields, like Options and Padding, may not always be present and their usage is relatively rare. The majority of IPv4 packets use a minimal header with standard values in the header fields.

Subnetting

Subnetting is the process of dividing a single IPv4 network into multiple smaller networks, called subnets. This is done by using a subnet mask to specify which bits of the IP address are used for the network ID and which bits are used for the host ID.

For example, the subnet mask 255.255.255.0 divides the network 192.168.1.0 into 256 subnets, each with 254 usable host addresses.

CIDR Notation

CIDR notation (Classless Inter-Domain Routing) is a more concise way to represent subnet masks. It uses a slash (/) followed by a number to specify the number of bits in the network ID.

For example, the subnet mask 255.255.255.0 can also be represented as /24. This means that the first 24 bits of the IP address are used for the network ID and the remaining 8 bits are used for the host ID.

Reserved Addresses

There are a number of IPv4 addresses that are reserved for special purposes. These addresses should not be used for regular devices on a network.

Some examples of reserved addresses include:

• 0.0.0.0 – Network address
• 255.255.255.255 – Broadcast address
• 127.0.0.0 – Localhost address
• 10.0.0.0 – 10.255.255.255 – Private network addresses
• 172.16.0.0 – 172.31.255.255 – Private network addresses
• 192.168.0.0 – 192.168.255.255 – Private network addresses

Common Commands

Here are some common IPv4 commands:

• ifconfig or ip addr – Displays information about network interfaces and addresses
• ping – Sends an ICMP echo request to a specified host
• traceroute – Traces the route that packets take to reach a specified host
• nslookup – Looks up DNS records for a specified domain name or IP address

Advanced Commands

Here are some advanced IPv4 commands:

• arp – Displays and manipulates the ARP cache
• route – Displays and manipulates the routing table
• netstat – Displays network statistics
• tcpdump – Captures and analyzes network traffic
• iproute2 – A suite of command-line tools for controlling Linux networking

Professional Notes

• When configuring IPv4 networks, it is important to choose the appropriate subnet mask. The subnet mask should be large enough to accommodate the desired number of subnets and hosts, but not so large that it wastes IP addresses.
• It is also important to be aware of the reserved IPv4 addresses. These addresses should not be used for regular devices on a network.
• When troubleshooting IPv4 networks, the following commands can be useful:
  • ping – Used to verify connectivity to a specific host.
  • traceroute – Used to trace the route that packets take to reach a specific host.
  • arp – Used to display and manipulate the ARP cache.
  • route – Used to display and manipulate the routing table.
  • netstat – Used to display network statistics.
• For more advanced IPv4 troubleshooting, the tcpdump command can be used to capture and analyze network traffic.