Network Intrusion Analysis · Topic 4 of 7
Protocol Headers: Ethernet, IP, TCP, UDP and ICMP
Read the fields of Ethernet, IPv4, IPv6, TCP, UDP and ICMP headers and see how each field helps an analyst spot scanning, spoofing and other attacks.
- 5 min
- Includes a diagram
- An Ethernet frame holds destination and source MAC addresses and an EtherType.
- The IPv4 protocol field is 1 for ICMP, 6 for TCP and 17 for UDP.
- TTL drops by one at each router, and IPv6 calls it the hop limit.
What it is
Every packet is built from headers, and the fields in those headers are the facts an analyst reads to understand traffic.
The lower layers come first. An Ethernet frame carries an IP packet, and the IP packet carries a TCP segment, a UDP datagram or an ICMP message.
Knowing the fields lets you read a capture and say what it shows. It also lets you spot values that should not be there.
How it works
Each header has a few key fields, and each has a typical meaning in an investigation.
Ethernet frame
| Field | Meaning |
|---|---|
| Destination MAC | The hardware address of the receiver on this link |
| Source MAC | The hardware address of the sender on this link |
| EtherType | The protocol inside, such as 0x0800 for IPv4, 0x86DD for IPv6 and 0x0806 for ARP |
| Payload | The packet inside the frame |
| Frame check sequence | A check value to detect damage |
A frame may also carry an 802.1Q VLAN tag. MAC addresses only have meaning on the local link, so they change at each router. Two different MAC addresses claiming one IP address is a sign of ARP spoofing.
IPv4
| Field | Meaning |
|---|---|
| Version | 4 |
| Header length | Length of the header, longer if options are present |
| Total length | Size of the whole packet |
| Identification, flags and fragment offset | Used to fragment and rebuild packets |
| TTL | Time to live, which drops by one at each router |
| Protocol | The next header, such as 1 for ICMP, 6 for TCP and 17 for UDP |
| Header checksum | Detects errors in the header |
| Source and destination address | Who sent it and where it goes |
A low TTL can show that a packet crossed many routers, and tools such as traceroute use TTL on purpose. Fragmentation can be used to hide an attack from simple inspection. A source address that does not belong on that network suggests spoofing.
IPv6
IPv6 has a fixed header of 40 bytes with fewer fields. They are the version, traffic class, flow label, payload length, next header, hop limit, and 128 bit source and destination addresses.
The next header field plays the role of the IPv4 protocol field, and hop limit replaces TTL. IPv6 has no header checksum and no fragmentation fields in the base header. Fragmentation uses an extension header.
TCP
| Field | Meaning |
|---|---|
| Source and destination port | The client and the service |
| Sequence and acknowledgment numbers | Order and delivery tracking |
| Flags | Control bits such as SYN, ACK, FIN, RST, PSH and URG, which control the connection |
| Window | How much data the receiver can accept |
| Checksum | Detects errors |
A normal connection starts with a three way handshake. The client sends SYN, the server replies SYN and ACK, and the client sends ACK.
Flag patterns show intent. Many SYN packets with no completed handshake suggest a SYN flood or a scan.
A packet with no flags set, or with FIN, PSH and URG together, is not normal and is typical of some scans. A RST often means that a port is closed or that a connection was refused.
UDP
UDP has a very small header with the source port, destination port, length and checksum. It has no handshake, no sequence numbers and no flags.
Because it is connectionless, the source address is easy to forge. That is why UDP services are often used in reflection attacks.
ICMP
ICMP carries control and error messages inside IP. The key fields are the type, the code and a checksum.
| Type | Meaning |
|---|---|
| 8 | Echo request, the ping |
| 0 | Echo reply |
| 3 | Destination unreachable, with a code for the reason |
| 11 | Time exceeded, which traceroute uses |
A run of echo requests to many addresses suggests a ping sweep. Very large ICMP packets, or large amounts of data in echo packets, can suggest tunnelling.
Reading the headers together
Combine the fields to tell a story. A capture shows one source sending SYN packets to many destination ports on one host, and the host replying with RST for most. That pattern is a port scan.
What to remember for the exam
Seven facts cover most questions on this topic.
- An Ethernet frame holds destination and source MAC addresses and an EtherType.
- The IPv4 protocol field is 1 for ICMP, 6 for TCP and 17 for UDP.
- TTL drops by one at each router, and IPv6 calls it the hop limit.
- IPv6 has a fixed 40 byte base header with 128 bit addresses.
- TCP uses a SYN, SYN and ACK, ACK handshake, and its flags show the connection state.
- UDP has no handshake, so source addresses are easy to forge.
- ICMP type 8 is an echo request, and type 0 is an echo reply.
Odd flag combinations and many SYN packets with RST replies are classic signs of scanning.
Common mistakes
These four errors appear often.
Expecting MAC addresses to cross routers. They only describe each local hop.
Mixing up TCP and UDP behaviour. Only TCP has a handshake and sequence numbers.
Forgetting the IPv6 next header. It takes the place of the IPv4 protocol field.
Reading every ICMP packet as an attack. Ping and traceroute are normal tools.
Header checksums can look wrong in a capture taken on the sending host because of offloading, so do not treat that alone as an attack.
Check yourself
Work through these three questions.
Which IPv4 field says whether the payload is TCP, UDP or ICMP?
The protocol field, which is 6 for TCP, 17 for UDP and 1 for ICMP.
What pattern of TCP flags suggests a SYN scan or flood?
Many SYN packets that never complete the handshake, often with RST replies from closed ports.
Why is spoofing easier with UDP than with TCP?
UDP has no handshake, so the sender does not need to receive replies, and a forged source address still works.
Topic 4 of 7 in Network Intrusion Analysis
Test yourself on Network Intrusion Analysis
The full Cisco CCNA 200-201 CBROPS question bank has 754 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.