In the IP packet header there is an 8-bit Protocol field (at offset 9) that holds the "next level protocol", with assigned numbers given in RFC 790. For example, TCP is 6. My question is, why is the IP layer aware of higher layers in the network stack?

enter image description here

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Commented Dec 20, 2020 at 17:59

5 Answers 5


Every "header" has some sort of "Next Protocol" identification field. This is necessary because on the wire, the data is nothing but a string of 1's and 0's. The receiving endpoint must have a way of interpreting what the next bits refer to.

If not for such a field which definitively indicates how to interpret the next set of 1's and 0's, there would be no way of determining if the next 32 bits were a TCP Sequence number or the IP Source Address (for instance). Both those fields are indeed 32 bits, so there is no way to programmatically determine what those 1's and 0's actually mean -- other than some sort of "Next Protocol" field.

  • 1
    This is not 100% correct, not each protocol has this, certainly not explicitly. e.g. in tcp/udp it is derived from the protocol and only has local meaning. port 17782 can first be used by an browser for HTTP and the next time by a download client using FTP. Also, MPLS for example has no such field at all, it's all defined by context.
    – KillianDS
    Commented Feb 9, 2015 at 12:21
  • 1
    @KillianDS I see your point. You could argue, that once TCP/UDP have gotten to their respective destination, at that point all that is left is for the application to simply receive/send the stream of bits... and at that point, its up to the Application to determine if further encapsulation/session identification is required. And as for MPLS, true, it isn't in the header, but the interfaces are configured to explicitly expect an MPLS tag, so I would view that as more of an exception than a rule. But none the less, I see and acknowledge your point -- feel free to edit and improve my answer.
    – Eddie
    Commented Feb 10, 2015 at 5:43
  • @KillianDS - I'd argue that it is 100% true, except that in cases where the next protocol is guaranteed to be known, 0 bits are allocated for it in the protocol header (information theory allocates 0 bits for data with 0 entropy). I don't get your point with "local meaning". Almost nothing in networking is guaranteed to have a consistent global meaning (due to address translations and implementation tweaks).
    – caveman
    Commented Dec 20, 2020 at 4:23
  • @KillianDS - Wireshark is irrelevant here. It is a middle man that has no clue of administrator's configuration at the ends of the communication. With the case of MPLS, the involved ends do not use heuristics themselves; they rather have the next-protocol-ID defined in them by the system admin explicitly (hence 0 bits allocated in the protocol header itself because of information theory). If someone wants to sniff MPLS packets in the middle, someone who has no knowledge of the system admins' configurations at the end, then that person will use heuristics, but MPLS is not made for him.
    – caveman
    Commented Dec 23, 2020 at 13:49
  • @KillianDS - The MPLS header does have the tagging system, which functions as a generalised next-hop protocol specification that can mean "IP is next" (and does eventually). The MPLS RFC discusses how tags can specify net-hope protocol specification. Just because such tagging doesn't have a global default (e.g. 80 = HTTP), it doesn't mean that it doesn't have a next-hop mapping.
    – caveman
    Commented Dec 25, 2020 at 16:12

The IPv4 protocol field allows the endpoint to determine what type of data is in the packet. The endpoint's IP layer uses the protocol field to determine which protocol to hand the packet off to.


Why is the IP layer aware of higher layers in the network stack?

An IP packet has a payload that must be passed to some other process. The IPv4 Protocol field (IPv6 Next Header field does the same thing) tells IP where to pass the payload of the IP packet.

The protocols in other layers have an equivalent type of field to know where to pass their payloads. For example, ethernet has the Ethertype field to tell it to which process (ARP, IPv4, IPX, IPV6, AppleTalk, etc.) to pass its payload, and transport protocols have addresses (ports) to tell them to which process to pass their payloads.

why is the IP layer aware of higher layers in the network stack?

Because IP is not the final destination of the packet payload. Each layer needs to know where to send its payload, but that does not mean that any layer really knows what is in the payload, or what the next layer actual is or does with the payload. As far as IP is concerned, it passes the packet payload to the process that registered with it at the protocol number, not that the payload is going to any specific transport protocol because IP knows nothing about transport protocols.


From Wikipedia:

Layer 3: Network layer

The network layer provides the functional and procedural means of transferring variable length data sequences (called datagrams) from one node to another connected to the same network. A network is a medium to which many nodes can be connected, on which every node has an address and which permits nodes connected to it to transfer messages to other nodes connected to it by merely providing the content of a message and the address of the destination node and letting the network find the way to deliver ("route") the message to the destination node. In addition to message routing, the network may (or may not) implement message delivery by splitting the message into several fragments, delivering each fragment by a separate route and reassembling the fragments, report delivery errors, etc.

Datagram delivery at the network layer is not guaranteed to be reliable. A number of layer-management protocols, a function defined in the management annex, ISO 7498/4, belong to the network layer. These include routing protocols, multicast group management, network-layer information and error, and network-layer address assignment. It is the function of the payload that makes these belong to the network layer, not the protocol that carries them.

Each layer supports the layers about it, that is the how the OSI Model is designed.

enter image description here

  • 6
    Welcome to the NE community. I went ahead and cited the content that looks like it came directly from Wikipedia for you. On the Stack Exchange sites, we like to make sure that credit is given where credit is due and avoid any accusations of plagiarism. It is fine to quote content from other sites, but please provide the references from which it originated in the future.
    – YLearn
    Commented Dec 29, 2014 at 16:11

Protocols that can encapsulate multiple upper layer protocols need some way of indicating what that upper layer protocol is. Ethernet uses an Ethertype field, with 0x0800 denoting IP, and 0x0806 representing ARP. TCP uses well known port numbers, with e.g. 80 representing HTTP. HTTP uses the Content-Type: header field.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.