← Interview Prep

Protocol Headers — Field Reference

The wire format of every header you're expected to sketch at a whiteboard: Ethernet, VLAN, ARP, IPv4, IPv6, ICMP, TCP, UDP, MPLS, VXLAN/GRE, and the routing protocols (OSPF, BGP, IS-IS).

Interviewers love "draw the header." The point isn't memorizing every bit — it's knowing the size, the purpose, and the one or two fields that carry real meaning. This page walks the stack bottom-up, encapsulation by encapsulation.

Read a packet outside-in: Ethernet → (VLAN) → IPv4/IPv6 → (MPLS/GRE/VXLAN) → TCP/UDP/ICMP → payload. Each header's "next-protocol" field (EtherType, IP Protocol, IPv6 Next Header, UDP dst port) tells the parser what comes next — that chain is demultiplexing.

Ethernet II frame (L2)

The frame the NIC actually clocks onto the wire. Preamble + SFD (8 bytes) and the inter-frame gap are handled by the PHY and are not part of the frame the driver sees. A frame is 64–1518 bytes (1522 with a VLAN tag); the 64-byte minimum is why short frames get padded.

bytes:        6             6            2         46 - 1500      4
       +-------------+-------------+-----------+---------------+-------+
       | Destination |   Source    | EtherType |    Payload    |  FCS  |
       |     MAC     |     MAC     | / Length  |    (data)     | (CRC) |
       +-------------+-------------+-----------+---------------+-------+
       |<---------------- 64 - 1518 bytes on the wire ------------>|

 Drawn left-to-right by byte order — Ethernet fields don't align to 32-bit
 words, so this is a byte layout, not a bit-field diagram like IPv4/TCP below.

Field	Size	Purpose
Destination / Source MAC	48 bits each	Hardware addresses. First byte's low bits: `I/G` (0=unicast, 1=multicast/broadcast) and `U/L` (locally administered).
EtherType	16 bits	Next protocol: `0x0800` IPv4, `0x86DD` IPv6, `0x0806` ARP, `0x8100` 802.1Q, `0x8847` MPLS. Values ≤ 1500 mean "length" (802.3).
Payload	46–1500 bytes	The MTU is the upper bound (1500 standard, up to ~9000 for jumbo frames). Under 46 → padded.
FCS	32 bits	CRC-32 over the frame; a mismatch is counted as a CRC error and the frame is dropped.

802.1Q VLAN tag

Inserted between Source MAC and EtherType — 4 bytes that push the max frame to 1522. Q-in-Q (802.1ad) stacks two tags (outer S-tag 0x88A8 + inner C-tag).

Field	Size	Purpose
TPID	16 bits	Tag Protocol ID = `0x8100` — what a receiver sees in the EtherType slot to know a tag follows.
PCP	3 bits	Priority Code Point — the L2 CoS (802.1p), 8 classes.
DEI	1 bit	Drop Eligible Indicator (formerly CFI).
VID	12 bits	VLAN ID — 0–4095 (0 and 4095 reserved), the reason a switch tops out at ~4094 VLANs.

Jumbo frames & MTU

The standard Ethernet payload MTU is 1500 bytes (frame ≈ 1518, or 1522 with a VLAN tag). A jumbo frame carries a payload larger than 1500 — commonly up to 9000 bytes (many switches cap at 9216). Jumbo frames are not part of the IEEE 802.3 standard; they're a widely supported de-facto extension.

Why: one 9000-byte frame replaces ~6× 1500-byte frames — fewer headers, interrupts, and per-packet CPU/PPS for the same throughput. Big win for storage (iSCSI/NFS), backups, replication, and east-west DC traffic.
MTU is an L2 property of the whole path: every NIC and switchport a frame crosses must agree on the same MTU. A mismatch causes silent drops (oversized frame → discarded as a giant) or, for IP with DF clear, fragmentation — a classic "works for small packets, stalls on bulk" black hole.
Overlay headroom: VXLAN/MPLS/GRE add ~50 bytes of outer encapsulation, so fabrics raise the underlay MTU (e.g. 9000/9216) to still fit a full 1500-byte tenant frame — this is the main reason DC underlays run jumbo.
Baby giants: frames only slightly over 1500 (e.g. 1504–1600) to absorb 802.1Q/Q-in-Q or MPLS labels without full jumbo support.
Caveat: the FCS stays 32 bits, so CRC-32's error-detection strength is spread over a larger frame — a reason some low-latency/lossy environments stay at 1500.

ARP (IPv4 ↔ MAC resolution)

Rides directly in Ethernet (EtherType 0x0806), no IP header. 28 bytes for the IPv4-over-Ethernet case. "Who has 10.0.0.1? Tell 10.0.0.2" is a broadcast request; the reply is unicast.

Field	Size	Purpose
Hardware type (HTYPE)	16 bits	1 = Ethernet.
Protocol type (PTYPE)	16 bits	`0x0800` = IPv4 (same numbering as EtherType).
HLEN / PLEN	8 bits each	Hardware/protocol address lengths (6 and 4).
Operation (OPER)	16 bits	1 = request, 2 = reply.
SHA / SPA	48 / 32 bits	Sender hardware & protocol address.
THA / TPA	48 / 32 bits	Target hardware (unknown in a request) & protocol address.

IPv6 has no ARP — it uses NDP (Neighbor Solicitation/Advertisement) carried inside ICMPv6.

IPv4 header (L3)

20 bytes without options, up to 60 with them. EtherType 0x0800.

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-------+-------+---------------+-------------------------------+
|Version|  IHL  |    DSCP  |ECN |         Total Length          |
+-------+-------+---------------+-----+-------------------------+
|         Identification         |Flags|    Fragment Offset     |
+---------------+---------------+-----+-------------------------+
|      TTL      |    Protocol   |        Header Checksum        |
+---------------+---------------+-------------------------------+
|                     Source IP Address                         |
+---------------------------------------------------------------+
|                  Destination IP Address                       |
+---------------------------------------------------------------+
|                    Options (0–40 bytes)                       |
+---------------------------------------------------------------+

Field	Size	Purpose
Version	4 bits	= 4.
IHL	4 bits	Header length in 32-bit words (5 = 20 bytes, max 15 = 60).
DSCP + ECN	6 + 2 bits	The old ToS byte: DSCP is the QoS class; ECN signals congestion without dropping.
Total Length	16 bits	Header + data, so a datagram maxes at 65,535 bytes.
Identification	16 bits	Groups fragments of one original datagram.
Flags	3 bits	Reserved(0), `DF` (Don't Fragment — the bit PMTUD relies on), `MF` (More Fragments).
Fragment Offset	13 bits	Position of this fragment in 8-byte units.
TTL	8 bits	Hop count; decremented each router, 0 → dropped + ICMP Time Exceeded (how traceroute works).
Protocol	8 bits	Next header: `6` TCP, `17` UDP, `1` ICMP, `89` OSPF, `47` GRE, `4` IP-in-IP, `112` VRRP.
Header Checksum	16 bits	Header only — recomputed at every hop because TTL changes.
Source / Destination IP	32 bits each	The addresses NAT rewrites.
Options	0–40 bytes	Rare: Record Route, Timestamp, source routing.

IPv6 header (L3)

A fixed 40 bytes — deliberately simpler than IPv4: no header checksum, no in-network fragmentation, no options in the base header (they move to extension headers). EtherType 0x86DD.

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-------+---------------+---------------------------------------+
|Version| Traffic Class |             Flow Label                |
+-------+---------------+-------------------+-------------------+
|         Payload Length          |  Next Header  |  Hop Limit  |
+---------------------------------+---------------+-------------+
|                                                               |
+                    Source Address (128 bits)                  +
|                                                               |
+---------------------------------------------------------------+
|                                                               |
+                 Destination Address (128 bits)                +
|                                                               |
+---------------------------------------------------------------+

Field	Size	Purpose
Version	4 bits	= 6.
Traffic Class	8 bits	DSCP + ECN, same role as IPv4's ToS byte.
Flow Label	20 bits	Tags a flow so routers can keep it on one path (ECMP hashing) without deep inspection.
Payload Length	16 bits	Length of everything after the 40-byte base header (extension headers + L4).
Next Header	8 bits	Same numbering as IPv4 Protocol; also chains extension headers. ICMPv6 = `58`.
Hop Limit	8 bits	The renamed TTL.
Source / Destination	128 bits each	16-byte addresses — the whole reason IPv6 exists.

Extension headers

Optional headers are daisy-chained via Next Header between the base header and L4, each pointing at the next. Order matters. The ones to know:

Hop-by-Hop Options (0) — examined by every router (e.g. Jumbograms, router alert).
Routing (43) — source routing; type 4 is the Segment Routing Header (SRH) for SRv6.
Fragment (44) — fragmentation is now host-only; routers never fragment IPv6.
Destination Options (60), AH (51) & ESP (50) for IPsec.

ICMP / ICMPv6

Control & error signaling. ICMP rides in IPv4 (protocol 1); ICMPv6 in IPv6 (Next Header 58) and also carries NDP and MLD. Minimal header — the meaning is in Type/Code.

Field	Size	Purpose
Type	8 bits	ICMPv4: 8/0 echo req/reply, 3 dest unreachable, 11 time exceeded, 5 redirect. ICMPv6: 128/129 echo, 133–137 NDP (RS/RA/NS/NA/Redirect).
Code	8 bits	Sub-type, e.g. type 3 / code 4 = "fragmentation needed & DF set" — the PMTUD message.
Checksum	16 bits	ICMPv6 checksum covers an IPv6 pseudo-header (ICMPv4's does not).
Rest of header	32 bits	Type-specific: Identifier + Sequence for echo, next-hop MTU for "frag needed", etc.

TCP segment header (L4)

20 bytes without options, up to 60 with them. IP protocol 6. The 4-tuple (src IP, src port, dst IP, dst port) identifies a connection.

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-------------------------------+-------------------------------+
|          Source Port          |       Destination Port        |
+-------------------------------+-------------------------------+
|                        Sequence Number                        |
+---------------------------------------------------------------+
|                     Acknowledgment Number                     |
+-------+-----------+-----------+-------------------------------+
|Offset | Reserved  |  Flags    |            Window             |
+-------+-----------+-----------+-------------------------------+
|           Checksum            |         Urgent Pointer        |
+-------------------------------+-------------------------------+
|                     Options (0–40 bytes)                      |
+---------------------------------------------------------------+

Field	Size	Purpose
Source / Destination Port	16 bits each	Endpoint demultiplexing.
Sequence Number	32 bits	Byte offset of the first data byte (ISN on the SYN).
Acknowledgment Number	32 bits	Next byte expected — cumulative. Valid only when ACK set.
Data Offset	4 bits	Header length in 32-bit words (hence the 60-byte cap).
Flags	—	`SYN ACK FIN RST PSH URG` + `ECE CWR` (ECN) + `NS`.
Window	16 bits	Receiver's free buffer — flow control (scaled by the Window Scale option).
Checksum	16 bits	Covers header + data + a pseudo-header with the IPs — why NAT must recompute it.
Urgent Pointer	16 bits	Offset of urgent data when URG set (rare).
Options	0–40 bytes	MSS, Window Scale, SACK-permitted/SACK, Timestamps.

Full mechanics: TCP — Theory & Mechanisms.

UDP datagram header (L4)

Just 8 bytes — no state, no reliability. IP protocol 17. The base for DNS, DHCP, VoIP, VXLAN, and QUIC/HTTP-3.

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-------------------------------+-------------------------------+
|          Source Port          |       Destination Port        |
+-------------------------------+-------------------------------+
|            Length             |           Checksum            |
+-------------------------------+-------------------------------+

Field	Size	Purpose
Source / Destination Port	16 bits each	Demultiplexing; dst port also selects the app protocol (53 DNS, 67/68 DHCP, 4789 VXLAN).
Length	16 bits	Header + data (minimum 8).
Checksum	16 bits	Optional in IPv4 (0 = none), mandatory in IPv6; covers a pseudo-header.

MPLS label (the "2.5" shim)

Sits between L2 and L3 (EtherType 0x8847 unicast / 0x8848 multicast). A 4-byte shim, and labels stack — the bottom one carries the S bit. Transit LSRs forward on the top label alone and never look at L3.

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-----------------------------------------------+-----+-+-------+
|                 Label (20 bits)               | TC  |S|  TTL  |
+-----------------------------------------------+-----+-+-------+

Field	Size	Purpose
Label	20 bits	The forwarding index (swapped hop by hop). 0–15 reserved (3 = implicit-null → PHP).
TC / EXP	3 bits	Traffic Class (QoS), formerly "EXP".
S	1 bit	Bottom-of-Stack — set on the last label before the payload.
TTL	8 bits	Own hop counter; uniform vs pipe mode controls whether it's copied to/from IP TTL.

A typical VPN packet carries two labels: outer = transport (LDP/RSVP/SR, to the egress PE), inner = service (VPN/VC, identifies the customer VRF or pseudowire). More: MPLS — Theory.

Overlay encapsulations — VXLAN & GRE

VXLAN (MAC-in-UDP)

Wraps a full L2 frame in UDP (dst port 4789) for L2-over-L3 fabrics/EVPN. 8-byte header; total overhead ~50 bytes (outer Eth+IP+UDP+VXLAN), which is why fabrics raise the MTU.

Field	Size	Purpose
Flags	8 bits	The `I` bit must be 1 → VNI is valid.
Reserved	24 + 8 bits	Unused.
VNI	24 bits	VXLAN Network Identifier — ~16M segments vs 4094 VLANs (the scale win).

GRE

Generic point-to-point tunnel, IP protocol 47. Minimal 4-byte header, plus optional fields.

Field	Size	Purpose
Flags + Version	16 bits	C (checksum present), K (key present), S (sequence present), version.
Protocol Type	16 bits	EtherType of the payload (e.g. `0x0800` IPv4, `0x6558` for NVGRE/Ethernet).
Key / Sequence	32 bits each (opt.)	Optional tunnel key (multiplexing) and sequence number.

Routing protocol headers

Where each control-plane protocol actually rides — a favorite trap ("what transport does OSPF use?").

Protocol	Runs on	Neighbor / transport
OSPF	IP protocol `89`	Multicast `224.0.0.5/6` (v2), no TCP/UDP; own reliable flooding.
IS-IS	Directly on L2 (CLNS)	No IP at all — PDUs in the frame; multicast MAC `0180.C200.0014/15`.
BGP	`TCP/179`	Unicast TCP session to a configured peer — the only IGP/EGP that's connection-oriented.
RIP	`UDP/520`	Multicast `224.0.0.9` (v2).
EIGRP	IP protocol `88`	Multicast `224.0.0.10`; RTP for reliability.
LDP	UDP/646 discovery, TCP/646 session	Hello over multicast, label exchange over TCP.
VRRP	IP protocol `112`	Multicast `224.0.0.18`.

OSPFv2 common header (24 bytes)

Every OSPF packet (Hello, DBD, LSR, LSU, LSAck) starts with this; the Type field selects which.

Field	Size	Purpose
Version	8 bits	= 2.
Type	8 bits	1 Hello, 2 DB Description, 3 LS Request, 4 LS Update, 5 LS Ack.
Packet Length	16 bits	Including this header.
Router ID	32 bits	Originating router.
Area ID	32 bits	The area this packet belongs to.
Checksum	16 bits	Whole packet.
AuType + Authentication	16 + 64 bits	Auth scheme (null/simple/crypto) + data.

BGP message header (19 bytes)

Fixed header in front of every BGP message on the TCP session.

Field	Size	Purpose
Marker	16 bytes	All ones — historically for auth/sync, now a framing delimiter.
Length	16 bits	Total message length, 19–4096 (or 65535 with extended-message support).
Type	8 bits	1 OPEN, 2 UPDATE, 3 NOTIFICATION, 4 KEEPALIVE, 5 ROUTE-REFRESH.

The UPDATE carries the substance: withdrawn routes, path attributes (AS_PATH, NEXT_HOP, LOCAL_PREF, MED, communities), and NLRI. MP-BGP moves NLRI into MP_REACH/UNREACH_NLRI attributes (AFI/SAFI) to carry IPv6, VPNv4/v6, and EVPN. See BGP — Theory and MP-BGP.

IS-IS header

No IP — the PDU sits straight in the L2 frame. Fixed common header then TLVs.

Field	Size	Purpose
Intradomain Routing Protocol Discriminator	8 bits	= `0x83` — marks an IS-IS PDU.
Length Indicator	8 bits	Length of the fixed header.
Version / Protocol ID Extension	8 bits	= 1.
ID Length	8 bits	System-ID length (0 → default 6 bytes).
PDU Type	5 bits	Hello (L1/L2/P2P), LSP, CSNP, PSNP.
Max Area Addresses	8 bits	Then everything else is TLVs — the extensibility that let IS-IS carry IPv6 and SR with no new PDU.

Detail: IS-IS — Theory.

One-glance size cheat sheet

Header	Size	Next-protocol field → value
Ethernet II	14 B (+4 VLAN, +4 FCS)	EtherType → 0x0800 / 0x86DD / 0x0806 / 0x8847
IPv4	20–60 B	Protocol → 6 / 17 / 1 / 89 / 47
IPv6	40 B fixed	Next Header → 6 / 17 / 58 / 43 (+ ext. headers)
TCP	20–60 B	Dst port → application
UDP	8 B	Dst port → application
ICMP / ICMPv6	8 B (+ data)	Type/Code
MPLS label	4 B each (stackable)	S bit → then IP or another label
VXLAN	8 B (UDP 4789)	VNI → inner Ethernet frame
GRE	4–16 B (IP proto 47)	Protocol Type → payload EtherType

Likely follow-up questions

Why does IPv6 drop the header checksum and in-network fragmentation? (L2/L4 already checksum; push fragmentation to hosts, keep routers fast.)
Which field makes traceroute work — and in which header? (TTL / Hop Limit.)
What does the MPLS S bit do, and why two labels in an L3VPN packet?
What transport does OSPF use? BGP? IS-IS? (IP proto 89; TCP/179; directly on L2.)
Why must NAT recompute the TCP/UDP checksum? (It covers a pseudo-header with the IP addresses.)
VLAN vs VXLAN scale limits — where do the 4094 and 16M numbers come from? (12-bit VID vs 24-bit VNI.)
Where does an 802.1Q tag go in the frame, and what's the TPID value? (Before EtherType; 0x8100.)
How does IPv6 chain extension headers, and which one is the SRv6 SRH? (Next Header chaining; Routing type 4.)

Related: Life of a Packet · TCP Theory · MPLS Theory · BGP Theory.