The IP Protocol, Fragmentation, ARP, DHCP, ICMP and NAT

IP delivers datagrams from a source host to a destination host across many networks. It is connectionless and best effort: datagrams may be lost, duplicated or delivered out of order, and IP does nothing about it. Reliability is left to TCP.

The IPv4 header

The header is 20 bytes without options, and at most 60 bytes.

Two quick consequences:

• Data length = total length − 4 × HLEN. With HLEN = 8 and total length 1000, the header is 32 bytes and the data 968 bytes.
• TTL stops a datagram from looping forever when routing tables are wrong. traceroute sends datagrams with TTL = 1, 2, 3, ... and collects the ICMP "time exceeded" messages each router returns.

Fragmentation

Every link has a maximum transmission unit (MTU), the largest IP datagram it can carry (1500 bytes on Ethernet). A router that must forward a datagram larger than the next link's MTU splits it into fragments, each a datagram with its own header. Fragments are reassembled only at the destination, never by routers.

Rules for each fragment:

1. The data in every fragment except the last must be a multiple of 8 bytes (because the offset counts 8-byte units).
2. Offset = (position of the fragment's first data byte in the original data) / 8.
3. MF = 1 on every fragment except the last; the identification is copied from the original.
4. If DF = 1 and fragmentation is needed, the router drops the datagram and sends an ICMP error.

Example: a 4000-byte datagram (20-byte header, 3980 bytes of data) reaches a link with MTU 1500. Each fragment can carry at most ⌊(1500 − 20) / 8⌋ × 8 = 1480 bytes of data.

def fragment(total_length, mtu, header=20):
    data = total_length - header
    per_fragment = (mtu - header) // 8 * 8      # multiple of 8 bytes
    frags, start = [], 0
    while start < data:
        size = min(per_fragment, data - start)
        more = start + size < data
        frags.append((size + header, start // 8, int(more)))
        start += size
    return frags

print("total length  offset  MF")
for length, offset, mf in fragment(4000, 1500):
    print(f"{length:12}  {offset:6}  {mf:2}")

total length  offset  MF
        1500       0   1
        1500     185   1
        1040     370   0

The offsets 0, 185 and 370 mean the data starts at bytes 0, 185 × 8 = 1480 and 370 × 8 = 2960. Fragmentation adds overhead: three headers (60 bytes) instead of one.

The receiver knows it has every fragment when the pieces cover the data from offset 0 to the fragment with MF = 0 without gaps. If any fragment is lost, the whole datagram is discarded. Because of this, modern hosts prefer path MTU discovery (send with DF = 1 and shrink the size whenever an ICMP "fragmentation needed" error comes back) instead of relying on fragmentation.

ARP: from IP address to MAC address

To send a datagram to the next hop on an Ethernet, the sender needs the next hop's MAC address. The Address Resolution Protocol (ARP) finds it:

1. The sender broadcasts an ARP request: "Who has 192.168.1.1? Tell 192.168.1.10."
2. The owner of that address unicasts an ARP reply with its MAC address.
3. Both sides store the mapping in their ARP cache for a few minutes.

If the destination is on another network, the sender resolves the MAC address of its default gateway (router), not of the final destination. The IP addresses in the datagram stay the same along the path; the MAC addresses change at every hop.

DHCP: getting an address

A new host has no IP address. The Dynamic Host Configuration Protocol gives it one, together with the subnet mask, default gateway and DNS server, as a time-limited lease. It runs over UDP (server port 67, client port 68) in four steps, known as DORA:

The client uses 0.0.0.0 as its source address and 255.255.255.255 as the destination until it has an address.

ICMP: errors and diagnostics

The Internet Control Message Protocol carries error reports and queries for IP. ICMP messages travel inside IP datagrams (protocol 1).

No ICMP error is ever sent about an ICMP error message, a fragment other than the first, or a broadcast datagram, so errors cannot multiply.

NAT: many hosts behind one address

Network Address Translation lets a whole private network (addresses such as 192.168.x.x) share one public IP address. The NAT router rewrites each outgoing datagram's source (private address, port) to (public address, new port), records the mapping in a translation table, and reverses the rewrite for replies.

NAT saves IPv4 addresses, but it breaks the end-to-end model: a host outside cannot start a connection to a host inside unless a mapping (port forwarding) is set up. Because it rewrites addresses and ports, NAT must also recompute the IP and TCP/UDP checksums.

IPv6 in brief

Practice questions