How to read a packet, explained
Every packet carries its own labels. Here is what the IPv4 and TCP headers tell you, and why firewall rules and cloud security groups are written in terms of them, with links to the standards themselves.
- What it is
A packet is data in nested headers.
A link-layer frame carries the IP header, which holds the source and destination addresses. The TCP header follows it and holds the ports and flags, and then comes the payload, the actual data. (Here "packet" is used loosely for the IP datagram together with its link-layer frame. Ethernet frames also add a trailer, and other link types use their own framing.)
Source: RFC 9293 (TCP), section 3.1; RFC 1122, section 2.3.3
- How it works
The IP header has fixed fields.
In IPv4 the fields sit in a fixed order: version (4), time to live, protocol, source address and destination address, with a few others in between. Time to live drops by at least one at every module that processes the packet, and a packet whose value reaches zero is destroyed. Protocol says what is inside: 6 is TCP and 17 is UDP. The smallest header is 20 bytes (the header length field has a minimum value of 5 words of 4 bytes).
- Why it matters
Firewall rules match these fields.
NIST describes a basic packet filter as controlling access using the packet's source address, its destination address, the network or transport protocol, and possibly the source and destination ports. An AWS security group inbound rule is built from a source, a port range and a protocol (outbound rules use a destination). More advanced firewalls look at more than headers.
Source: NIST SP 800-41 Rev. 1, section 2.1.1; AWS VPC security groups
The takeaway: A packet is nested headers. The IP header gives its lifetime, protocol and addresses, and the TCP header gives the ports and flags. Firewall and security group rules match those same fields, so reading the headers is how you read the rule.
More short lessonsADIR also offers a free external pen test for cloud teams: see the offer.
Transcript
Every packet on a network comes with its own labels. Here's how to read them. A packet is data wrapped in nested headers. A link-layer frame carries the IP header, which holds the source and destination addresses. Inside that is the TCP header, with the ports and flags. Last comes the payload, the actual data. Now the IP header. Its fields sit in a fixed order. Version is four. Time to live drops by at least one at every device that handles the packet, and at zero, the packet is discarded. Protocol says what's inside: six means TCP, seventeen means UDP. Then come the source and destination addresses. The smallest header is twenty bytes. Firewalls read these fields. A basic packet filter decides using the source address, the destination address, the protocol, and the ports. An AWS security group rule is built from the same pieces: a source, a port range, and a protocol. So, a packet is nested headers. The IP header gives its lifetime, protocol, and addresses. And firewall rules match those same fields.
Narrated with an AI voice.
