Wireshark
the world's foremost network protocol analyzer
Display Filter Reference: Internet Protocol Version 4
Protocol field name: ip
Versions: 1.0.0 to 1.6.5
Back to Display Filter Reference
| Field name | Type | Description | Versions |
|---|---|---|---|
| ip.addr | IPv4 address | Source or Destination Address | 1.0.0 to 1.6.5 |
| ip.checksum | Unsigned integer, 2 bytes | Header checksum | 1.0.0 to 1.6.5 |
| ip.checksum_bad | Boolean | Bad | 1.0.0 to 1.6.5 |
| ip.checksum_good | Boolean | Good | 1.0.0 to 1.6.5 |
| ip.dsfield | Unsigned integer, 1 byte | Differentiated Services field | 1.0.0 to 1.6.5 |
| ip.dsfield.ce | Unsigned integer, 1 byte | ECN-CE | 1.0.0 to 1.4.11 |
| ip.dsfield.dscp | Unsigned integer, 1 byte | Differentiated Services Codepoint | 1.0.0 to 1.6.5 |
| ip.dsfield.ecn | Unsigned integer, 1 byte | Explicit Congestion Notification | 1.6.0 to 1.6.5 |
| ip.dsfield.ect | Unsigned integer, 1 byte | ECN-Capable Transport (ECT) | 1.0.0 to 1.4.11 |
| ip.dst | IPv4 address | Destination | 1.0.0 to 1.6.5 |
| ip.dst_host | Character string | Destination Host | 1.0.0 to 1.6.5 |
| ip.flags | Unsigned integer, 1 byte | Flags | 1.0.0 to 1.6.5 |
| ip.flags.df | Boolean | Don't fragment | 1.0.0 to 1.6.5 |
| ip.flags.mf | Boolean | More fragments | 1.0.0 to 1.6.5 |
| ip.flags.rb | Boolean | Reserved bit | 1.0.0 to 1.6.5 |
| ip.flags.sf | Boolean | Security flag | 1.4.0 to 1.6.5 |
| ip.frag_offset | Unsigned integer, 2 bytes | Fragment offset | 1.0.0 to 1.6.5 |
| ip.fragment | Frame number | IPv4 Fragment | 1.0.0 to 1.6.5 |
| ip.fragment.count | Unsigned integer, 4 bytes | Fragment count | 1.6.0 to 1.6.5 |
| ip.fragment.error | Frame number | Defragmentation error | 1.0.0 to 1.6.5 |
| ip.fragment.multipletails | Boolean | Multiple tail fragments found | 1.0.0 to 1.6.5 |
| ip.fragment.overlap | Boolean | Fragment overlap | 1.0.0 to 1.6.5 |
| ip.fragment.overlap.conflict | Boolean | Conflicting data in fragment overlap | 1.0.0 to 1.6.5 |
| ip.fragment.toolongfragment | Boolean | Fragment too long | 1.0.0 to 1.6.5 |
| ip.fragments | Sequence of bytes | IPv4 Fragments | 1.0.0 to 1.6.5 |
| ip.geoip.asnum | Character string | Source or Destination GeoIP AS Number | 1.2.1 to 1.6.5 |
| ip.geoip.city | Character string | Source or Destination GeoIP City | 1.2.1 to 1.6.5 |
| ip.geoip.country | Character string | Source or Destination GeoIP Country | 1.2.1 to 1.6.5 |
| ip.geoip.dst_asnum | Character string | Destination GeoIP AS Number | 1.2.1 to 1.6.5 |
| ip.geoip.dst_city | Character string | Destination GeoIP City | 1.2.1 to 1.6.5 |
| ip.geoip.dst_country | Character string | Destination GeoIP Country | 1.2.1 to 1.6.5 |
| ip.geoip.dst_isp | Character string | Destination GeoIP ISP | 1.2.1 to 1.6.5 |
| ip.geoip.dst_lat | Character string | Destination GeoIP Latitude | 1.2.1 to 1.6.5 |
| ip.geoip.dst_lon | Character string | Destination GeoIP Longitude | 1.2.1 to 1.6.5 |
| ip.geoip.dst_org | Character string | Destination GeoIP Organization | 1.2.1 to 1.6.5 |
| ip.geoip.isp | Character string | Source or Destination GeoIP ISP | 1.2.1 to 1.6.5 |
| ip.geoip.lat | Character string | Source or Destination GeoIP Latitude | 1.2.1 to 1.6.5 |
| ip.geoip.lon | Character string | Source or Destination GeoIP Longitude | 1.2.1 to 1.6.5 |
| ip.geoip.org | Character string | Source or Destination GeoIP Organization | 1.2.1 to 1.6.5 |
| ip.geoip.src_asnum | Character string | Source GeoIP AS Number | 1.2.1 to 1.6.5 |
| ip.geoip.src_city | Character string | Source GeoIP City | 1.2.1 to 1.6.5 |
| ip.geoip.src_country | Character string | Source GeoIP Country | 1.2.1 to 1.6.5 |
| ip.geoip.src_isp | Character string | Source GeoIP ISP | 1.2.1 to 1.6.5 |
| ip.geoip.src_lat | Character string | Source GeoIP Latitude | 1.2.1 to 1.6.5 |
| ip.geoip.src_lon | Character string | Source GeoIP Longitude | 1.2.1 to 1.6.5 |
| ip.geoip.src_org | Character string | Source GeoIP Organization | 1.2.1 to 1.6.5 |
| ip.hdr_len | Unsigned integer, 1 byte | Header Length | 1.0.0 to 1.6.5 |
| ip.host | Character string | Source or Destination Host | 1.0.0 to 1.6.5 |
| ip.id | Unsigned integer, 2 bytes | Identification | 1.0.0 to 1.6.5 |
| ip.len | Unsigned integer, 2 bytes | Total Length | 1.0.0 to 1.6.5 |
| ip.proto | Unsigned integer, 1 byte | Protocol | 1.0.0 to 1.6.5 |
| ip.reassembled.length | Unsigned integer, 4 bytes | Reassembled IPv4 length | 1.4.0 to 1.6.5 |
| ip.reassembled_in | Frame number | Reassembled IPv4 in frame | 1.0.0 to 1.6.5 |
| ip.src | IPv4 address | Source | 1.0.0 to 1.6.5 |
| ip.src_host | Character string | Source Host | 1.0.0 to 1.6.5 |
| ip.tos | Unsigned integer, 1 byte | Type of Service | 1.0.0 to 1.6.5 |
| ip.tos.cost | Boolean | Cost | 1.0.0 to 1.6.5 |
| ip.tos.delay | Boolean | Delay | 1.0.0 to 1.6.5 |
| ip.tos.precedence | Unsigned integer, 1 byte | Precedence | 1.0.0 to 1.6.5 |
| ip.tos.reliability | Boolean | Reliability | 1.0.0 to 1.6.5 |
| ip.tos.throughput | Boolean | Throughput | 1.0.0 to 1.6.5 |
| ip.ttl | Unsigned integer, 1 byte | Time to live | 1.0.0 to 1.6.5 |
| ip.version | Unsigned integer, 1 byte | Version | 1.0.0 to 1.6.5 |