Flags: Specify if a packet can be fragmented and if so, whether or not the current packet contains the final fragment.Identification: Uniquely identifies a set of fragments.Differentiated Services: Specifies special requirements of the traffic (like how VOIP requires real-time data streaming).Version: Specifies that this is an IPv4 header (important since IPv6 is also in use).The purpose of this header is to describe how a certain packet should be handled during routing.

The image above shows a screenshot of an IPv4 header in Wireshark. A range of IPv4 addresses can be specified by writing the first address in the range and the number of bits that are uniquely specified. Its addresses are written as four dot-separated octets, each with possible values of 0–255. IPv4 is the primary Internet Protocol in use.

As a result, it is possible that a network traffic capture will contain IPv6 traffic carried over the IPv4 protocol. However, some computers and subnets have switched over to IPv6. With NAT, an entire organization’s network can have a single IP address on the public internet and be uniquely addressed internally using private IP address ranges (10.0.0.0/8,172.16.0.0/12 and 192.168.0.0/16). The planned switchover from IPv4 to IPv6 never happened due to the widespread usage of Network Address Translation (NAT). This concern was valid, especially since there are at least 4,536,248,808 internet users and only 4,294,967,296 possible IPv4 addresses (not taking into account the private IPv4 address ranges that cannot be allocated to a specific user). IPv6 was designed to solve the problem of IPv4 address exhaustion, which was the concern that there would be more computers on the internet than there were possible IP addresses. In 1995, RFC 1883 was published, officially specifying the current version of the IP version 6 (IPv6) protocol. However, IPv4 isn’t the most recent version of the IP protocol. This form of traffic header uses IP addresses in the range of 0.0.0.0 to 255.255.255.255. Most of the internet operates based off of IP version 4 or IPv4. IP is unusual in that there isn’t only one version of IP traffic headers.

Wireshark filter network subnet