Wireshark - PCAP Reader - Internet Protocol Portion

[DailyDose]

I recently created a PCAP reader in LabVIEW that can dig out the actual payload.  Nothing too complicated.  However there's one bit in there that I don't entirely trust my understanding.  I'm more guessing how it works.  Was hoping someone with a firmer networking grasp could confirm or correct for me.

The following portion defines the Header Length bytes.  But what about it actually makes up that number?

With other pcaps I've looked at, I've concluded that to mean, Version times Header Length = # of bytes - in this case 4 x 5 = 20

Am I wrong?  Or is that the correct way to interpret that?

[ZYOng]

Have you checked out Raw Ethernet Frame Decode and Encode Example?

[playerm1 · Accepted solution]

IHL (Internet Header Length) is a 4-bit field that specifies the number of 32-bit words (4 bytes) in the header.  This value can vary from 5 to 15, which would give a total header length anywhere from 20 bytes to 60 bytes.  The IHL x version number is probably just a coincidence that it matches the minimum total header length.

Take a look here at the IHL definition:

https://en.wikipedia.org/wiki/Internet_Protocol_version_4#Packet_structure

[DailyDose]

Thank you for the link.  Yep, sure enough, just a coincidence.  Will make that change immediately.  Thank you!

[DailyDose]

---

@playerm1 wrote:

IHL (Internet Header Length) is a 4-bit field that specifies the number of 32-bit words (4 bytes) in the header.  This value can vary from 5 to 15, which would give a total header length anywhere from 20 bytes to 60 bytes.  The IHL x version number is probably just a coincidence that it matches the minimum total header length.

Take a look here at the IHL definition:

https://en.wikipedia.org/wiki/Internet_Protocol_version_4#Packet_structure

---

Because I was curious, though, I looked up IPV6 to see if that would make any difference.  Wiki wasn't as straight forward as it was for IPV4.  But from what I read, it does look like it'll be a larger header.  Just not as sure where to find that info. X number of 128 bits.  So I guess for now, this PCAP parser is strictly IPV4 capable.