IP Header Decoder

Decode IPv4 and IPv6 packet headers from hex dumps. Visualize fields: version, TTL, protocol, source/destination.

Tested tool guide Tested browser tools Checked August 16, 2026

What IP Header Decoder does, with a checked example

Turn an IP header written as hexadecimal bytes into readable IPv4 or IPv6 fields. The decoder separates packed bits and multi-byte values to expose addresses, lengths, fragmentation information, TTL or Hop Limit, and the protocol identifier. The important surprise is that a Protocol or Next Header value describes what the header says should follow. It does not prove that the corresponding TCP, UDP, extension, or other header is present in the pasted data.

Worked example

A concrete input and expected output from the current implementation.

Input

45 00 00 14 12 34 40 00 40 06 3c 79 c0 00 02 01 c6 33 64 02

Expected output

Version: 4
Header length: 20 bytes
DSCP: 0
ECN: 0
Total length: 20 bytes
Identification: 4660 (0x1234)
Flags: DF set, MF clear
Fragment offset: 0
TTL: 64
Protocol: 6 (TCP)
Header checksum: 0x3c79
Source: 192.0.2.1
Destination: 198.51.100.2

The leading 0x45 contains version 4 and an Internet Header Length of five 32-bit words, or 20 bytes. The total length is also 20, while 0x40 gives TTL 64, 0x06 identifies TCP, and the final eight address bytes convert to the two dotted-decimal addresses shown. The IPv4 header checksum reconciles to 0xffff when included in the one's-complement sum.

How the result is produced

IPv4 field map

For IPv4, the first byte supplies the version and Internet Header Length. The decoder maps the network-order bytes to DSCP and ECN, total length, identification, flags, fragment offset, TTL, protocol, header checksum, and two 32-bit addresses. The IHL value determines where any IPv4 options end and where the following payload would begin.

IPv6 base header

For IPv6, the fixed 40-byte base header carries version, traffic class, flow label, payload length, Next Header, Hop Limit, and 128-bit source and destination addresses. Next Header is an assigned protocol number. It can identify an upper-layer protocol directly or identify an IPv6 extension header whose own Next Header field continues the chain.

Good uses

Check a copied packet-capture header when source, destination, TTL, Hop Limit, or protocol information is not immediately visible in the hex view.
Inspect IPv4 identification, fragmentation flags, and fragment offset while determining whether several captured fragments belong to the same datagram.
Verify that a handcrafted IP header used in a test fixture encodes the intended version, declared length, addresses, and next-protocol value.

Limits and checks

The pasted bytes must begin at the IP header. Ethernet, VLAN, capture metadata, or textual byte offsets before it can shift every field away from its defined position.
IPv4 Total Length and IPv6 Payload Length are values declared by the sender. Decoding them does not establish that the pasted dump contains the declared number of bytes.
An IPv4 fragment offset is measured in units of eight bytes, not individual bytes. A zero offset can still describe the first fragment when the More Fragments flag is set.

Common questions

Where should the hex dump begin?

Begin with the IP version byte: it normally starts with hexadecimal 4 for IPv4 or 6 for IPv6. If a capture includes an Ethernet or other link-layer header, locate the start of its IP payload first. Supply the header bytes themselves without address offsets or a printable ASCII column so those characters cannot be mistaken for packet data.

Why does IPv6 show Next Header instead of Protocol?

IPv4 has a Protocol field, while IPv6 uses Next Header because the next item may be TCP, UDP, ICMPv6, an IPv6 extension header, or no next header. If the value identifies an extension header, the IPv6 base header alone does not identify the final upper-layer protocol. Follow each extension header's Next Header field in sequence.

References and verification

The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools

Password Generator

Generate strong, random passwords with customizable length, character sets, and complexity requirements.

Password Strength Checker

Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.

Random String Generator

Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.

QR Code Generator

Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.

QR Code Reader

Scan and decode QR codes from uploaded images or your device camera to extract embedded data.

File Checksum Calculator

Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.