Vol. I · No. 46The protocol sectionSat, 10 Oct 2026
Layer 3 · Network protocol

IPv4

the Internet Protocol, version 4

IPv4 is the addressing and delivery system of the internet. It gives every host a 32-bit address, wraps data in packets stamped with source and destination, and lets routers carry each one hop by hop — best-effort, across any number of networks.

IPv4 gives every host an address and carries packets to it hop by hop, best-effort.

You can run this one

Open the IP lab →

A datagram finds its way across a real LAN: forwarding decision, NAT/PAT at the gateway, TTL falling hop by hop.

Intermediate
Operates at
Layer 3
Network
Address
32-bit
~4.3 billion
Delivery
Best-effort
connectionless
Unit
Packet
TTL-limited

How it works

One packet, carried hop by hop toward its address
Source
10.0.0.9
TTL 64
Router
TTL 63
Router
TTL 62
Destination
203.0.113.5
Each packet carries this header
016 bits31
Ver · IHL
DSCP · ECN
Total length
Identification
Flags
Fragment offset
TTL
Protocol
Header checksum
Source address
Destination address
Options (if any)
Data — usually a TCP or UDP segment

Every router reads the destination address, forwards the packet one hop closer, and drops the TTL by one — so a packet that can’t find its way eventually dies instead of looping forever.

The main points

What IPv4 does, step by step

1
Address the packet

It stamps the data with a 32-bit source and destination address so any router can place it.

2
Route hop by hop

Each router matches the destination against its table and forwards the packet one step closer — independently, per packet.

3
Count down the TTL

Each hop drops the Time-To-Live by one; at zero the packet is discarded, killing routing loops.

4
Fragment if it must

If a link’s MTU is too small, the packet is split into fragments and reassembled at the destination.

In cybersecurity

IPv4 carries no identity and no encryption, so the source address can’t be trusted and the payload rides in the clear.

IP spoofing

A forged source address hides the sender and powers reflection attacks; ingress filtering fights it.

No confidentiality

Encrypt at the network layer with IPsec, or above it with TLS.

Fragmentation attacks

Overlapping or tiny fragments can evade filters and crash weak reassemblers.

TTL-based recon

Watching TTLs (as traceroute does) maps the path and fingerprints hosts.

Address exhaustion

Only ~4.3 billion addresses forced NAT everywhere — and pushed the move to IPv6.

DDoS at the packet level

Floods of spoofed packets saturate links regardless of what rides above.

Rides in the stack

EthernetIPv4TCP / UDP

Works with

IPv6ICMPTCPUDP

See it on Linux

hostnameip addrifconfignmcliip routeip neighnetstatpingtraceroutemtrnmaptcpdumpnftiptablesufw

Reading an address

203.0.113.5
203.0.113the network
.5the host
/24how many bits are the network

Four bytes, dotted — the mask splits them into network and host.