In the IP packet header there is an 8-bit Protocol field (at offset 9) that holds the "next level protocol", with assigned numbers given in RFC 790. For example, TCP is 6. My question is, why is the IP layer aware of higher layers in the network stack?

enter image description here

  • 1
    Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 2:36

Every "header" has some sort of "Next Protocol" identification field. This is necessary because on the wire, the data is nothing but a string of 1's and 0's. The receiving endpoint must have a way of interpreting what the next bits refer to.

If not for such a field which definitively indicates how to interpret the next set of 1's and 0's, there would be no way of determining if the next 32 bits were a TCP Sequence number or the IP Source Address (for instance). Both those fields are indeed 32 bits, so there is no way to programmatically determine what those 1's and 0's actually mean -- other than some sort of "Next Protocol" field.

  • This is not 100% correct, not each protocol has this, certainly not explicitly. e.g. in tcp/udp it is derived from the protocol and only has local meaning. port 17782 can first be used by an browser for HTTP and the next time by a download client using FTP. Also, MPLS for example has no such field at all, it's all defined by context. – KillianDS Feb 9 '15 at 12:21
  • @KillianDS I see your point. You could argue, that once TCP/UDP have gotten to their respective destination, at that point all that is left is for the application to simply receive/send the stream of bits... and at that point, its up to the Application to determine if further encapsulation/session identification is required. And as for MPLS, true, it isn't in the header, but the interfaces are configured to explicitly expect an MPLS tag, so I would view that as more of an exception than a rule. But none the less, I see and acknowledge your point -- feel free to edit and improve my answer. – Eddie Feb 10 '15 at 5:43

The IPv4 protocol field allows the endpoint to determine what type of data is in the packet. The endpoint's IP layer uses the protocol field to determine which protocol to hand the packet off to.


From Wikipedia:

Layer 3: Network layer

The network layer provides the functional and procedural means of transferring variable length data sequences (called datagrams) from one node to another connected to the same network. A network is a medium to which many nodes can be connected, on which every node has an address and which permits nodes connected to it to transfer messages to other nodes connected to it by merely providing the content of a message and the address of the destination node and letting the network find the way to deliver ("route") the message to the destination node. In addition to message routing, the network may (or may not) implement message delivery by splitting the message into several fragments, delivering each fragment by a separate route and reassembling the fragments, report delivery errors, etc.

Datagram delivery at the network layer is not guaranteed to be reliable. A number of layer-management protocols, a function defined in the management annex, ISO 7498/4, belong to the network layer. These include routing protocols, multicast group management, network-layer information and error, and network-layer address assignment. It is the function of the payload that makes these belong to the network layer, not the protocol that carries them.

Each layer supports the layers about it, that is the how the OSI Model is designed.

enter image description here

  • 6
    Welcome to the NE community. I went ahead and cited the content that looks like it came directly from Wikipedia for you. On the Stack Exchange sites, we like to make sure that credit is given where credit is due and avoid any accusations of plagiarism. It is fine to quote content from other sites, but please provide the references from which it originated in the future. – YLearn Dec 29 '14 at 16:11

Protocols that can encapsulate multiple upper layer protocols need some way of indicating what that upper layer protocol is. Ethernet uses an Ethertype field, with 0x0800 denoting IP, and 0x0806 representing ARP. TCP uses well known port numbers, with e.g. 80 representing HTTP. HTTP uses the Content-Type: header field.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.