IPv4 Header Parser
Paste a raw IPv4 packet header as hex and decode every field: version, IHL, DSCP/ECN, total length, identification, flags (DF/MF), fragment offset, TTL, protocol, header checksum (validated), and the source and destination addresses. Spaces, colons, dashes, dots, and a 0x prefix are ignored. Runs in your browser; nothing is uploaded.
About this tool
IPv4 Header Parser decodes a raw IPv4 packet header, given as a hex string, into every field of the 20-byte (or longer, with options) header:
- Version & IHL — the IP version (4) and the Internet Header Length in 32-bit words, plus the header length in bytes.
- DSCP & ECN — the Differentiated Services Code Point (named when a well-known class such as CS0, EF, or AF21) and the Explicit Congestion Notification, both decoded from the Type-of-Service byte.
- Total Length — the full packet length and the implied payload length.
- Identification & fragmentation — the identification field, the DF (Don't Fragment) and MF (More Fragments) flags, and the fragment offset in both 8-byte units and bytes.
- TTL & Protocol — the Time To Live and the protocol number, named when known (e.g. TCP, UDP, ICMP, GRE, ESP, OSPF).
- Header Checksum — the stored checksum and whether it is valid, recomputed over the header with the one's-complement algorithm (RFC 1071).
- Addresses — the source and destination IPv4 addresses in dotted decimal.
- Options — any IP options bytes when IHL > 5.
The header is the IPv4 portion of a packet — the part after the link-layer
frame and before the transport (TCP/UDP) data. Input may use spaces, colons,
dashes, dots, or a leading 0x; they are all ignored.
Example
45 00 00 3c 1c 46 40 00 40 06 b1 e6 c0 a8 00 68 c0 a8 00 01
└┬┘ └┬┘ └─┬─┘ └─┬─┘ └─┬─┘ └┬┘ └┬┘ └─┬─┘ └── src ──┘ └── dst ──┘
│ │ │ │ │ TTL │ │
│ ToS total id flags/ proto checksum
ver/IHL length frag-off
Common uses
- Read an IP header captured in Wireshark/tcpdump without re-opening the capture.
- Verify a header checksum, or confirm TTL, protocol, and addresses by hand.
- Inspect fragmentation (DF/MF, offset) and QoS marking (DSCP/ECN) on a packet.
FAQ
Can I paste the whole packet, or only the 20-byte header?
Paste as much as you like — the parser reads the first IHL × 4 bytes (20 bytes for a typical header, up to 60 with options) and ignores anything after them. The payload length shown is derived from the Total Length field minus the header length, so it is reported correctly even if you only pasted the header.
Why is the checksum reported as INVALID for a packet that clearly worked?
Usually checksum offload. When you capture on the sending host, the NIC
fills in the checksum in hardware after the capture point, so tools like
Wireshark record 0x0000 or a stale value. This tool recomputes the RFC 1071
one's-complement sum over the header bytes you pasted — capture on the
receiving side (or a middle hop) to see the real on-wire checksum.
How do I copy the header bytes out of Wireshark?
Select the "Internet Protocol Version 4" layer in the packet-detail pane,
right-click → Copy → …as a Hex Stream, and paste it here. Separators don't
matter: spaces, colons, dashes, dots, and a leading 0x are all stripped
before parsing.
Does it parse IPv6 headers too?
No. The version nibble must be 4; an IPv6 packet (version 6) is rejected with an explicit error. IPv6 uses a different, fixed 40-byte header with no checksum, so it needs a different parser.
Developer & Automation Access
Run it from the terminal
Same engine as this page, headless — via the gizza CLI:
gizza tool parse-ipv4-header "4500 003c 1c46 4000 4006 b1e6 c0a8 0068 c0a8 0001"New to the CLI? Get gizza →
Open it by URL
Pre-fill and auto-run this tool with query parameters — the names match the API/CLI:
https://gizza.ai/tools/parse-ipv4-header/?header=4500%20003c%201c46%204000%204006%20b1e6%20c0a8%200068%20c0a8%200001Machine-readable descriptor: tool.json — title + parameters JSON Schema for agents.