Packet-header gallery

Definitions in this gallery

• ARP packet arp-packetThe 28-octet request or reply that maps an IPv4 address to a MAC address on the local segment.ARP, GLBP
• MP_REACH_NLRI bgp-mp-reachPath attribute type 14: AFI/SAFI, a 16-octet IPv6 next hop, and one /32 IPv6 NLRI.VRF, EVPN, BGP
• BGP UPDATE bgp-updateA 45-octet UPDATE: header, no withdrawals, ORIGIN + AS_PATH + NEXT_HOP, and one IPv4 NLRI.BGP
• BFD Control packet bfd-controlTwenty-four octets sent at a rate both ends negotiate, carrying the state each believes the session is in and the reason it last left Up.BFD
• Configuration BPDU bpdu-configurationThe 35-octet message bridges exchange to agree on a root and a loop-free active topology.STP, RSTP, MSTP, PVST+
• Topology Change Notification BPDU bpdu-tcnFour octets sent toward the root when a bridge detects a topology change. It carries no detail — only the fact that something changed.STP
• DHCP message header dhcp-messageThe 44 fixed octets that carry a decision: who is asking, which transaction, which addresses, and which relay it came through.Port security, DHCP
• DNS message header dns-messageTwelve octets that classify every reply: which query it answers, whether it is authoritative, whether it was truncated, and how many records are in each of the four sections.DNS
• 802.1Q VLAN tag dot1q-tagFour octets carrying the VLAN identifier and priority, inserted between the source MAC address and the EtherType.VLANs
• EIGRP packet header eigrp-headerTwenty octets carrying EIGRP’s own reliable transport: an opcode, a sequence number, an acknowledgement number, and the AS number both ends must share.EIGRP
• ESP header esp-headerSecurity Parameters Index and sequence number in the clear; the rest of the ESP packet is encrypted payload plus trailer and ICV.IPsec
• Ethernet II frame header ethernet-frameFourteen octets: where it is going, where it came from, and what is inside. The second field is the one switches learn from and the first is the one they forward on.Ethernet, Port security, PTP, 802.11, CDP, vPC, 802.1X
• HSRP message hsrp-packetTwenty octets of UDP payload: version, opcode, state, timers, priority, group, clear-text authentication, and the virtual IP.HSRP
• HTTP/2 frame header http2-frameNine octets in front of every frame. The stream identifier is what turns one connection into many concurrent requests, and stream zero is the connection itself.HTTP, Reverse proxies
• IGMPv3 Membership Report igmp-messageThe host-to-router message that names which groups — and, in version 3, which sources — a receiver wants. One group record with one source is shown.IGMP
• IPFIX Message Header ipfix-headerSixteen octets: Version 10, Length, Export Time, Sequence Number, and Observation Domain ID.NetFlow / IPFIX
• IPv4 header ipv4-headerTwenty octets, unchanged since 1981 except for the one byte that has been redefined twice — and the three bits that decide whether a router may fragment.NAT, QoS, DMVPN, Subnetting, Static routing, IPv4 ACLs, PIM-DM, SD-WAN
• IS-IS LAN Hello isis-helloThe 27-octet LAN Hello without TLVs: common header, circuit type, source ID, holding time, priority and LAN ID.IS-IS
• IS-IS Link State PDU isis-lspThe 27-octet LSP header without TLVs: remaining lifetime, LSP ID, sequence number, checksum and the P/ATT/OL/IS-type flags.IS-IS
• LACPDU lacpduThe Slow Protocols frame that advertises one end’s system identity, key, and port state, and mirrors what it believes about the partner. Matching Actor and Partner information is what forms a bundle.LACP
• LLDPDU (mandatory TLVs) lldp-pduChassis ID, Port ID, TTL, and End of LLDPDU — the four mandatory TLVs every compliant advertisement must carry.LLDP
• MPLS label stack (two entries) mpls-label-stackEight octets: outer transport label (S=0) and inner VPN label (S=1).L3VPN, RSVP-TE, VPLS, SR-MPLS, LDP
• MSDP Source-Active TLV msdp-saOne announcement that a source is active, carrying the originating rendezvous point — the field peer-RPF checks and the reason a healthy session can have an empty cache.MSDP
• Neighbor Solicitation ndp-neighbor-solicitationICMPv6 Type 135 asking “who has this Target Address?” — the IPv6 replacement for ARP Request, also used for DAD.NDP
• NTP header ntp-packetForty-eight octets: leap, version, mode, stratum, poll, precision, root delay/dispersion, reference ID, and four timestamps.NTP
• OSPFv2 Database Description ospf-dbdThe 32-octet Database Description without LSA headers. Interface MTU, the I/M/MS flags, and the DD sequence number are what ExStart actually negotiates.OSPFv2
• OSPFv2 Hello ospf-helloThe 44-octet Hello without neighbors: identity, area, timers, priority, and the DR/BDR the sender currently believes in.OSPFv2, OSPFv3
• OSPFv2 LSA header ospf-lsa-headerTwenty octets that name an LSA: age, options, type, Link State ID, advertising router, sequence, checksum and length.Redistribution, OSPFv2
• PIM Bootstrap message pim-bootstrapHow a domain learns its RP set. It distributes candidates, not assignments — every router applies the same range, priority and hash rules to the same list and reaches the same answer alone.RP discovery
• PIM Join/Prune pim-join-pruneThe message that builds and tears down multicast trees. One group, one source shown: the WC and RPT bits are what make it a shared-tree join rather than a source-tree join.PIM-DM, SSM, PIM-SM, Bidir-PIM
• QUIC long header quic-headerLong-header prefix: form bit, fixed bit, packet type, version, and connection ID lengths — the visible structure before encrypted payload.QUIC
• RADIUS packet radius-packetTwenty-octet header (Code, Identifier, Length, Authenticator) then zero or more attributes.RADIUS
• RIPv2 Response ripv2-updateUDP/520 Response: command, version 2, then one route entry with mask and next hop — the fields that distinguish RIPv2 from RIPv1.RIPv2
• Segment Routing Header srv6-srhAn IPv6 routing header carrying the segment list. Eight octets of fixed fields and sixteen more per segment — which is where the MTU arithmetic comes from.SRv6
• TACACS+ header tacacs-headerTwelve octets: major/minor version, type, sequence, flags, session ID, and length — then an encrypted body.TACACS+
• TCP header tcp-headerTwenty octets: ports, sequence and ack, data offset, flags, window, checksum, urgent.IPv4 ACLs, TCP, NETCONF, Telemetry
• TLS record header tls-recordFive octets in front of every TLS record, two of which are deliberately misleading so that middleboxes leave the connection alone.TLS
• UDP header udp-headerTwo ports, a length and a checksum. Everything else people want from a transport has to be built above it — which is exactly why QUIC chose it.WireGuard, SNMP, 802.1X
• VRRP Advertisement vrrp-packetThe only VRRPv3 packet type: the master announces priority, interval, and the virtual IPvX address(es) so backups can elect and time out correctly.VRRP
• VXLAN header vxlan-headerEight octets: flags with the I bit set, a 24-bit VNI, and reserved fields of zero.VXLAN

EVPN route types 1–5