BYTETOOLS

IPv4 Header Decoder

Paste an IPv4 header hex dump and decode every field — version, IHL, DSCP, flags, TTL, protocol — and recompute the header checksum to verify it.

20 B
Header length
0
Options
0 B
Payload supplied
Valid
Checksum

Header fields

FieldRawMeaning
Version0x44 — IPv4
IHL (header length)0x55 words × 4 = 20 bytes
DSCP0x000 — CS0 / Default (best effort)
ECN0b00Not-ECT (00) — not ECN capable
Total length0x0073115 bytes (header + payload)
Identification0x00000
Flags0b010DF=1 (don't fragment), MF=0 (last fragment)
Fragment offset0x00000 × 8 = byte offset 0
Time to live0x4064 hops remaining
Protocol0x1117 — UDP
Header checksum0xb861valid
Source addressc0a80001192.168.0.1
Destination addressc0a800c7192.168.0.199

Header checksum

Stored: 0xb861· Recomputed with the one's-complement sum (checksum field zeroed): 0xb861

The checksum is valid — this header is intact.

Header bytes

45000073000040004011b861c0a80001c0a800c7

The total-length field claims a longer packet than you pasted, so the payload is truncated. The header decode above is still accurate.

What is the IPv4 Header Decoder?

The IPv4 Header Decoder takes a hex dump of an IP header and breaks it into named fields: version, IHL and the header length it implies, the DSCP and ECN bits split out of the ToS byte, total length, identification, the DF and MF flag bits, the 13-bit fragment offset and the byte offset it represents, TTL, the protocol number with its IANA name, and the source and destination addresses.

  • Every fixed field decoded with both its raw hex and its plain-English meaning
  • DSCP code points named (EF, AF41, CS6 and the rest) and ECN states spelled out
  • Header checksum recomputed with the one's-complement sum and verified
  • IP options walked as TLVs and named — record route, timestamp, router alert and more
  • Accepts spaced hex, continuous hex, 0x-prefixed bytes and Wireshark offset columns
  • Runs offline in your browser, so capture data never leaves the machine

How to use the IPv4 Header Decoder

  1. 1

    Copy the IPv4 header bytes from your capture — at least the first 20 bytes.

  2. 2

    Paste them into the hex dump box in any common format.

  3. 3

    Read the field table, which shows the raw value and its meaning side by side.

  4. 4

    Check the checksum panel to confirm the header is intact, then copy the summary line.

About the IPv4 Header Decoder

The IPv4 Header Decoder takes a hex dump of an IP header and breaks it into named fields: version, IHL and the header length it implies, the DSCP and ECN bits split out of the ToS byte, total length, identification, the DF and MF flag bits, the 13-bit fragment offset and the byte offset it represents, TTL, the protocol number with its IANA name, and the source and destination addresses.

It also recomputes the header checksum using the RFC 1071 one's-complement sum with the checksum field zeroed, so it can tell you whether the header you pasted is intact or corrupted. Any IP options past the fixed 20 bytes are walked as TLVs and named.

Paste from Wireshark, tcpdump, a hex editor or a log file — spaces, newlines, colons, 0x prefixes and offset columns are all handled. Decoding runs 100% locally in your browser, which matters when the capture contains real traffic.

Frequently asked questions

How do I read an IPv4 header in hex?

The first nibble is the version (4) and the second is the IHL in 32-bit words, so 45 means a 20-byte header. Byte 9 is the protocol, bytes 12–15 the source address and 16–19 the destination. This decoder does the whole walk for you and labels each field.

How is the IPv4 header checksum calculated?

Treat the header as a sequence of 16-bit words with the checksum field set to zero, add them with end-around carry, then take the one's complement. To verify a header you sum every word including the checksum — a valid header adds up to zero.

What do the DF and MF flags mean?

DF (don't fragment) tells routers to drop the packet rather than fragment it, which is how Path MTU Discovery probes for the largest size that fits. MF (more fragments) is set on every fragment except the last, so a receiver knows when reassembly is complete.

Why is the fragment offset multiplied by 8?

The field is only 13 bits, which cannot count up to 65,535 bytes. Storing the offset in 8-byte units stretches its range to cover a full-size datagram, at the cost of requiring every fragment except the last to be a multiple of 8 bytes long.

What does an invalid checksum mean?

Either the header was corrupted in transit, the dump is missing or has extra bytes, or you pasted a header from a NIC doing checksum offload — where the capture is taken before the hardware fills the field in. Check the byte count first; that is the usual cause.

Related tools