Logo

MonoCalc

/

IP Header Decoder

Networking
Paste hex bytes separated by spaces, colons, dashes, or as a continuous string. Minimum 20 bytes.

Sample Headers

About This Tool

IP Header Decoder – Parse IPv4 Headers from Hex

Every IPv4 packet begins with a 20-to-60 byte header that carries the routing and delivery metadata required to move the payload from source to destination. This tool accepts a hex dump of an IPv4 header (or a complete packet) and instantly parses each field according to RFC 791, the foundational standard that has defined IPv4 since 1981.

Structure of an IPv4 Header

The minimum IPv4 header is exactly 20 bytes (5 × 32-bit words). An optional Options field can extend it up to 60 bytes. The Internet Header Length (IHL) field in the first byte encodes the actual header size in 32-bit words, so an IHL of 5 means 20 bytes and an IHL of 6 means 24 bytes (4 bytes of options).

The fields, in order, are:

  • Version (4 bits) — always 4 for IPv4.
  • IHL (4 bits) — header length in 32-bit words (min 5, max 15).
  • DSCP (6 bits) — QoS class, e.g. 46 for Expedited Forwarding (voice/video).
  • ECN (2 bits) — congestion notification without packet loss (RFC 3168).
  • Total Length (16 bits) — complete packet size including payload, up to 65,535 bytes.
  • Identification (16 bits) — assigned by the sender to group fragments of the same datagram.
  • Flags (3 bits)— Reserved, DF (Don't Fragment), MF (More Fragments).
  • Fragment Offset (13 bits) — position of this fragment in 8-byte units from the start of the original datagram.
  • TTL (8 bits) — hop limit; decremented by each router; packet discarded when it reaches 0.
  • Protocol (8 bits) — identifies the encapsulated transport protocol (6 = TCP, 17 = UDP, 1 = ICMP).
  • Header Checksum (16 bits)— one's-complement checksum of the header; recalculated at every hop.
  • Source / Destination IP (32 bits each) — dotted-decimal IPv4 addresses.

How to Use This Tool

Paste a hex string representing the IPv4 header or a full captured packet. The tool accepts bytes in several formats — a continuous run like 4500002800014000400600000a0000010a000002, space-separated like 45 00 00 28 ..., colon-delimited like 45:00:00:28:..., or dash-delimited. A leading 0x prefix is also stripped automatically.

You can also click one of the Sample Headers presets to load a real-world example — a TCP SYN, a UDP datagram with DF set, or an ICMP packet with EF (Expedited Forwarding) DSCP marking.

DSCP and QoS Classification

The former Type of Service (ToS) byte was redefined by RFC 2474 into DSCP (6 bits) and ECN (2 bits). DSCP values map to well-known per-hop behaviours: CS0/BE (best-effort, default), AF11–AF43 (assured forwarding, four classes with three drop precedences each), and EF (expedited forwarding, DSCP 46, used for real-time voice). The decoder labels each DSCP value with its standard name so you can immediately identify QoS intent without consulting the RFC.

Fragmentation Fields

IPv4 fragmentation splits large datagrams into smaller packets when they exceed the path MTU. The Identification field ties fragments together; the MF flag indicates more fragments follow; the Fragment Offset positions each piece within the reassembled datagram. Modern networks often set DF=1 to rely on Path MTU Discovery (RFC 1191) instead of in-path fragmentation, which can cause reassembly issues and performance penalties.

Practical Uses

Network engineers and security researchers use IPv4 header analysis to troubleshoot connectivity issues, verify QoS markings, investigate packet captures from tools like Wireshark or tcpdump, and study protocol behaviour in labs. This decoder is particularly helpful when working with raw bytes exported from a packet analyser or embedded in log files, where a quick human-readable breakdown saves time compared to manually computing bit offsets from the RFC.

Frequently Asked Questions

Is the IP Header Decoder free?

Yes, IP Header Decoder is totally free :)

Can I use the IP Header Decoder offline?

Yes, you can install the webapp as PWA.

Is it safe to use IP Header Decoder?

Yes, any data related to IP Header Decoder only stored in your browser (if storage required). You can simply clear browser cache to clear all the stored data. We do not store any data on server.

How does the IP Header Decoder work?

Paste a hex string representing an IPv4 packet (or just its header) into the input field. The tool strips optional separators such as spaces, colons, or dashes, then parses each field according to RFC 791 — version, IHL, DSCP, ECN, total length, identification, flags, fragment offset, TTL, protocol, checksum, source IP, and destination IP — and displays a structured breakdown.

What format should the hex input be in?

The tool accepts hex bytes in several formats: a continuous string (4500002800014000400600000a0000010a000002), bytes separated by spaces (45 00 00 28 ...), colon-delimited (45:00:00:28:...), or dash-delimited (45-00-00-28-...). An optional leading '0x' prefix is also stripped. You need at least 20 hex-byte pairs (40 characters without separators) for a minimum IPv4 header.

What is IHL and why does it matter?

IHL (Internet Header Length) is the lower 4 bits of the first byte and specifies the header length in 32-bit words. The minimum value is 5 (20 bytes, no options). If IHL is greater than 5, the header contains options fields between byte 20 and the start of the payload. The tool highlights the options bytes separately so you can identify them.

What do the DSCP and ECN fields represent?

DSCP (Differentiated Services Code Point, bits 7–2 of byte 1) specifies the QoS class or priority for this packet — for example, DSCP 46 is Expedited Forwarding (EF), used for real-time voice. ECN (bits 1–0) enables congestion notification without packet drops: a router marks CE (0b11) instead of dropping the packet when a link is congested, and the receiver echoes this to the sender via TCP's ECE flag.

How do the Flags and Fragment Offset fields relate to fragmentation?

The 3-bit Flags field controls fragmentation: the DF (Don't Fragment) bit prevents routers from fragmenting the packet, and the MF (More Fragments) bit indicates that more fragments of the original datagram follow. The 13-bit Fragment Offset specifies where this fragment belongs within the reassembled datagram, in units of 8 bytes. A non-fragmented packet typically has DF=1 and Offset=0.

Does the tool validate the header checksum?

The tool displays the checksum value in hex but does not verify it. Checksum validation requires computing the one's-complement sum of the entire header, which changes at every router hop (TTL is decremented). For offline analysis or learning purposes the displayed raw value is sufficient; use Wireshark or a packet capture tool if you need live checksum verification.