The Internet Protocol

Right now, an incalculable number of small packets of data are crossing the planet. Every message sent, every photo opened and every second of video watched is chopped into pieces that travel independently, jumping from device to device until they reach their destination. In the demonstration below, you can set the amount of traffic with the slider and drag the scene to change the angle of view:

The coloured blocks are packets, and the bluish discs they pass through are routers. The colour of each packet shows which computer it is going to. Notice that no router knows the whole way: each one reads the destination address written on the packet, chooses which cable to send it down and hands it to a neighbour, which does the same.

The rules that define how these addresses work and how each packet should be treated along the way make up the Internet Protocol, or IP. It is the common layer that joins networks very different from one another. It works over copper cables, optical fibres, Wi‑Fi and mobile networks, and over it work the web, email, video calls and practically everything we do online.

In this guide, we will build IP from scratch. We will start with two computers joined by a wire and, step by step, get to addresses, masks, routing tables, the contents of a packet bit by bit and the mechanisms that keep everything working when things go wrong.

Bits on a wire

Let us start with the simplest setting there is: two computers joined by a single cable. For one to talk to the other, the transmitter must vary some physical quantity over time, and the receiver must measure it. In a copper cable, that quantity is the voltage; in an optical fibre, it is the intensity of the light.

If both sides agree that a high level means 1, that a low level means 0 and that each symbol lasts a fixed interval of time, any information can be sent as a sequence of bits. Below, the computer on the left sends the word Hi to the one on the right, enormously slowed down. The slider sets the transmission rate, that is, how many bits are sent per second:

With a higher rate, each bit lasts less time, and so it takes up a shorter stretch of the cable. The speed at which the signal travels along the cable, though, does not change: in copper as in fibre, it is around two thirds of the speed of light, about 200,000 kilometres per second. A faster connection does not make the first bit arrive sooner. It puts more bits on the wire every second, and that is why a whole message finishes arriving earlier.

But how did the text Hi become bits? Each character is turned into one or more bytes, groups of 8 bits, following a table of encoding. Today the most common is UTF‑8, in which letters without accents take one byte, and accented letters, like é or ç, take two. Type anything in the field below to see its bytes and bits:

Every kind of digital information, whether text, image or sound, ends up as a long sequence of bytes. From here on, we will not worry about what those bytes mean. For the network, they are just cargo to be carried.

Packets

With two computers and a wire, life is simple: everything that leaves one end reaches the other. Real networks, however, have many participants sharing the same cables. Imagine three computers that need to send data over one and the same link. Two of them are transferring large files, and the third wants to send only a short message.

If each one sends everything at once, in a single block, the others have to wait for it to finish. The solution the internet adopted is to break the data into small pieces, called packets, and to interleave everyone's packets on the same wire. In the demonstration below, the slider sets the maximum size of the packets, and the bars show the progress of each transfer:

With huge packets, the short message is stuck behind the two large files. With smaller packets, all of them move forward at the same time, and it arrives almost at once. There is another advantage: if a packet is corrupted on the way, only that piece needs to be sent again, not the whole file.

Notice the darker band at the front of each packet. Besides the data, every packet carries information for its control, such as the destination, in a part called the header. The data themselves are the payload. Since each packet carries its own header, packets that are too small spend a larger share of the link on headers, and large transfers take a little longer to finish. In practice, networks use packets of middling size, typically of up to 1,500 bytes.

This idea, called packet switching, was proposed independently in the 1960s by Paul Baran, in the United States, and by Donald Davies, in the United Kingdom. It differs from the circuit switching of the old telephone network, in which each call reserves a path of its own from end to end for the whole conversation, even in its silences.

Addresses

When several computers share a network, each packet must say who its recipient is. Local networks such as Ethernet and Wi‑Fi use for this the MAC address, a number of 48 bits written into the network card by its maker and usually shown as six pairs of hexadecimal digits: 3c:22:fb:9a:10:e4.

MAC addresses are unique, but they say nothing about where the device is. They work like a passport number: they identify someone exactly, but they do not help a postman find the house. In a local network that is no problem, because the device that joins the computers, the switch, simply remembers on which of its ports each address appeared. But what about a network the size of the planet?

In the demonstration below, a router needs to know how to reach all the computers of four networks. The stack beside it stands for its forwarding table, with one layer for each entry. Switch between flat addresses, like the MAC, and hierarchical addresses, in which the first part identifies the network and the second identifies the computer within it. The slider changes the number of computers in each network:

With flat addresses, the router needs an entry for each computer, and the table grows with the network. With hierarchical addresses, one entry per network is enough: all the addresses that begin with 3. go down the same cable, however many computers there are there. The internet has billions of devices, but the tables of the big routers have about a million entries, one for each block of addresses announced among the networks that make it up. Only the second approach can work.

Postcodes work the same way. In the United States, the first digit of a ZIP code names a group of states: 0 for New England and New Jersey, 1 for New York and Pennsylvania, 9 for the Pacific coast, and so on. The digits that follow narrow the place down. A sorting office in Los Angeles that receives a letter whose ZIP code begins with 0 knows that it must go to the north-east, without knowing the street it is going to. The IP address applies exactly this idea.

The IPv4 address

The version of IP used on the internet since 1983, IPv4, has addresses of 32 bits. To make them easier to read, they are written as four decimal numbers separated by dots, each standing for 8 bits, an octet. Click on the bits below to turn them on or off, or type an address in the field:

Each bit of an octet has a weight, which is a power of 2: from left to right, 128, 64, 32, 16, 8, 4, 2 and 1. The value of the octet is the sum of the weights of the bits that are on, and so each of the four numbers goes from 0 to 255.

With 32 bits, there are 2³² = 4,294,967,296 possible addresses, a little over 4 billion. It seemed a lot in 1981, when IPv4 was specified. Today there are more people in the world than addresses, and each person often has several connected devices. We will see further on how the internet copes with this scarcity.

Prefixes and masks

An IP address has two parts. The first, the network prefix, identifies the network. The second, the host identifier, identifies a device within it. Host is the technical name of any device that sends or receives packets: computers, phones, servers.

The boundary between the two parts is not fixed. It is given by a number after a slash: in 192.0.2.10/24, the first 24 bits form the prefix, and the other 8 identify the host. Drag the slider to change the length of the prefix and see what happens to the network:

Each bit added to the prefix halves the network. A /24 network spans 256 addresses; a /16, 65,536; a /8, more than 16 million. Two addresses of each network are reserved: the first, with all the bits of the host at 0, identifies the network itself, and the last, with all of them at 1, is the broadcast address, used to speak to all the devices of the network at once. That is why a /24 network holds 254 devices, and not 256.

The same boundary can be written as a network mask: a number of 32 bits with 1 in all the positions of the prefix and 0 in the others. The mask of a /24 network is 255.255.255.0, a form you have probably seen in the network settings of your computer.

Until 1993, the boundary was set by the first bits of the address itself, in a scheme of classes: class A networks had a /8 prefix; class B, /16; and class C, /24. A company that needed 2,000 addresses got a whole class B, with 65,536, and wasted nearly all of them. CIDR (Classless Inter-Domain Routing) did away with the classes and allowed prefixes of any length. That is why the notation with a slash is also called CIDR notation.

A map of all the addresses

It would be good to see the whole space of IPv4 addresses at once. We cannot line up 4 billion addresses in a row, but we can fold that row inside a square. Ideally, it would be folded so that addresses close in number are also close in the drawing.

The Hilbert curve does exactly that. It is built recursively: a square is divided into four parts, visited along a path in the shape of a U. Then each part is divided in the same way, with the U turned so that the end of one stretch joins the beginning of the next. Increase the order of the curve to see how:

The four colours show that the curve of each order is made of four copies of the curve of the order before. The curve of order n visits 4ⁿ cells; with order 16, that is 4¹⁶ = 2³² cells, one for each IPv4 address. Since each level of the recursion corresponds to 2 bits of the address, every block whose prefix has an even length becomes a square, and every block whose prefix has an odd length becomes a rectangle with one side twice as long as the other.

Below is the whole space of IPv4, drawn pixel by pixel by the graphics card. Each numbered square is a /8 block, with about 16.8 million addresses. Hover over the map to see the addresses, click or tap to choose one, and drag the slider to light up the block that holds the chosen address, from /0 to /32:

The regions in colour are blocks with special roles. The range 127.0.0.0/8 is that of loopback: packets sent to these addresses never leave the computer itself. The blocks 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 are private, reserved for internal networks; we will come back to them. The block 224.0.0.0/4 is used for multicast, the sending of one packet to a group of recipients, and 240.0.0.0/4 was reserved for a future use that never came. Several of the addresses used as examples in this guide, such as 192.0.2.10 and 203.0.113.80, come from blocks reserved for documentation.

All the rest, in grey, is public space, handed out to providers and organizations by five regional registries: ARIN, for North America; LACNIC, for Latin America and the Caribbean; the RIPE NCC, for Europe, the Middle East and Central Asia; AFRINIC, for Africa; and APNIC, for Asia and the Pacific.

Routing

With hierarchical addresses, taking a packet to its destination comes down to two cases. If the destination is on the same network as the sender, the packet can be delivered directly. If it is not, it is handed to a router, a device connected to more than one network, which takes care of passing it on.

To know which case it is in, the computer applies the network mask to its own address and to the destination address with the bitwise AND operation: each bit of the result is 1 only if both of the bits it comes from are 1. In practice, this wipes out the part of the host and leaves only the prefix. If the two prefixes are equal, the destination is on the same network. Choose a destination and set the length of the prefix of the network:

The router that receives the packets meant for other networks is the default gateway. In a home, that role belongs to the box installed by the internet provider, and its address appears in the network settings, usually something like 192.168.0.1 or 192.168.1.1.

The routing table

A router has several interfaces, each connected to a different network, and a routing table that ties prefixes to interfaces. When a packet arrives, the router compares its destination address with each prefix in the table. Often more than one entry fits. Then the most specific one wins, that is, the one with the longest prefix. Choose a destination for the packet:

The entry 0.0.0.0/0 has a prefix of length zero, and so it matches any address. It is the default route, used when no other fits, and it usually points to the internet provider. The rule of the longest prefix lets a router have a general rule for a large block and exceptions for parts of it, as in the hierarchy of ZIP codes.

Hop by hop

No router knows the whole way. Each one knows only the next hop for each destination. Drag the slider to follow a packet that leaves a computer at home for a server, and see, at each stage, which entry of which table chose the way:

Who fills in these tables? In small networks, an administrator can set them up by hand. On the internet, they are filled in automatically by routing protocols: neighbouring routers exchange messages telling which networks they can reach and at what cost. Within one organization, protocols such as OSPF are common. Among the nearly 80,000 independent networks that make up the internet, called autonomous systems, the protocol is BGP. These protocols deserve a guide of their own. For IP, it is enough to know that the tables exist and that each router looks up its own.

The header

It is time to open a packet. Every IPv4 packet begins with a header of at least 20 bytes, or 160 bits, divided into fields of fixed size. In the illustration below, each block is a bit of a real header: the tall blocks are 1, and the short ones, 0. Each field has its own colour. Drag to turn it, hover over the fields and use the slider to separate them:

By convention, the header is drawn in rows of 32 bits, read from left to right and from top to bottom, in the order in which the bits are sent. Click on a field of the diagram below to see what it does and where it is in the example packet, shown byte by byte, in hexadecimal, at the bottom:

It is worth going quickly through each field:

Version (4 bits) is always 4 in IPv4. It comes first so that the receiver knows how to read the rest.
IHL (4 bits) is the length of the header, counted in words of 32 bits. It is almost always 5, that is, 20 bytes.
DSCP and ECN (8 bits) mark the priority of the packet, for example to favour voice calls, and signal congestion.
Total length (16 bits) is the size of the whole packet, header and data, in bytes. The maximum is 65,535.
Identification, flags and fragment offset are used in fragmentation, which we will see further on.
TTL (8 bits) limits how many routers the packet can cross. We will see it further on too.
Protocol (8 bits) says what is in the payload: 6 for TCP, 17 for UDP, 1 for ICMP.
Header checksum (16 bits) serves to detect errors in the header itself.
Source address and destination address (32 bits each) need no introduction.

After them may come options, rarely used today. Notice also what is not in the header: there is no sequence number, no acknowledgement, nothing that guarantees delivery. We will come back to this.

Time to live

Routing tables are set up by people and by programs, and both make mistakes. Suppose that router A thinks the way to a certain network goes through B, that B thinks it goes through C, and that C thinks it goes through A. A packet for that network would go round in circles for ever, and with new packets coming into the loop, the links would end up completely congested.

To prevent this, every packet carries a counter, the TTL (Time To Live). Each router that receives the packet subtracts 1 from it. If the result is zero, the packet is discarded instead of forwarded. Use the slider to choose the initial TTL of the packet that enters the loop below:

The name comes from the first idea, which was to measure the lifetime in seconds. In practice, every router subtracts 1, and the field became a count of hops. Operating systems usually start it at values such as 64 (Linux, macOS, Android) or 128 (Windows), more than enough to cross the internet, where paths rarely go beyond 30 hops.

When it discards a packet whose TTL has run out, the router sends the sender a small error message with ICMP (Internet Control Message Protocol), a helper protocol of IP. The message says “time exceeded” and, an important detail, its source is the address of the router that sent it.

Traceroute

This detail allows a clever trick. Send a packet with TTL 1: the first router on the path discards it and replies with ICMP, revealing its address. Send another with TTL 2: now the one who replies is the second router. Repeating this, the whole path can be found. That is what the tool traceroute does (tracert, on Windows). Increase the TTL of the probes:

The time between sending the probe and the arrival of the reply, in milliseconds, gives an idea of the distance to each router. You can run traceroute or tracert in a terminal to see the real path that your packets take to some site. Some routers do not reply to probes and appear only as asterisks.

Checksum

Bits can be corrupted on the way by electrical interference or faults in the hardware. A flipped bit in the destination address would send the packet to the wrong place, and an error in the length field would confuse the receiver. To detect these problems, the IPv4 header includes a checksum.

The calculation is simple. The header is divided into words of 16 bits, with the checksum field set to zero for the moment, and the words are added up. Whenever the sum goes past 16 bits, the carry left over at the front is added back to the result. At the end, all the bits are inverted, and that is the value written in the field. Drag the slider to follow the sum:

Whoever receives the packet does the same sum, now including the checksum. Since the checksum is the inverse of the sum of all the rest, the result for an intact header is FFFF, with all 16 bits at 1. Click on any bit of the header below to simulate an error of transmission:

This method is easy to calculate, but it is not infallible: two errors that cancel each other out go unnoticed. Try flipping the same bit in two different words, one from 0 to 1 and the other from 1 to 0. For the header, the protection is enough. The payload is protected by other checks, made by the layers above and below.

Since the TTL changes at every hop, each router must update the checksum before sending the packet on. It is little work per packet, but large routers forward hundreds of millions of packets per second. IPv6, as we will see, dropped this field.

Fragmentation

Each technology of link has a maximum size of frame. In Ethernet, the payload of a frame can have up to 1,500 bytes. This limit is called the MTU (Maximum Transmission Unit). IPv4 allows packets of up to 65,535 bytes. What happens, then, when a packet larger than the MTU has to cross a link?

In IPv4, the router can fragment the packet: split its data into smaller pieces and give each piece a copy of the header. All the fragments get the same identification. The flag MF (More Fragments) is set on all of them but the last. And the offset says at which position of the original packet the data of each fragment begin, measured in units of 8 bytes. Set the size of the packet and the MTU of the second link:

size of the packet

MTU of link 2

The fragments travel on as independent packets and are put back together only at their final destination. If a single fragment is lost, the whole original packet is discarded. That is why fragmentation is avoided whenever possible.

The sender can set the flag DF (Don't Fragment). Then the router that would have to fragment the packet discards it and replies with an ICMP message that gives the MTU of the next link. The sender then starts sending smaller packets. This technique, path MTU discovery, is used by most connections today. Turn on DF in the demonstration above to see what happens.

Best effort

So far, every packet has reached its destination. But IP does not promise that. It offers a best effort service: each router tries to forward each packet, but if it cannot, it simply discards it, without telling anyone.

The most common cause of loss is congestion. A router can receive packets faster than it can send them out on a link. The packets in excess wait in a queue, in the router's memory, but memory is finite. In the demonstration below, set the rate of arrival of packets; the way out has a fixed capacity:

While the rate of arrival stays well below the capacity, hardly any queue forms. As it nears the capacity, the queue grows and each packet takes longer to get out. When it goes past the capacity, the queue fills up, and every packet that arrives is discarded. That is why, in a congested network, things first get slow, and then begin to fail.

Packets can also arrive out of order. Two packets one after the other can take different paths, for example when a route changes in the middle of a conversation, and the second can overtake the first. Below, the odd packets take the upper path, and the even ones the lower path, whose delay you can set:

This may look like a flaw, but it is a choice. Guaranteeing delivery and order would require each router to keep information about every conversation passing through it. Keeping the core of the network simple leaves the heavy work to its ends. TCP, a protocol that runs on the computers of the source and of the destination, over IP, numbers the data, acknowledges what it receives, sends again what was lost and puts back in order what arrived jumbled. Applications that prefer speed to guarantees, such as voice calls and games, can use UDP, which delivers the packets as they arrive.

This principle, of keeping the network simple and putting the intelligence at its edges, is known as the end-to-end argument, and many hold it to be one of the reasons for the success of the internet: since the network does very little, new applications can be made without asking anyone along the way for permission.

Layers

IP knows nothing about cables, radio frequencies or optical fibres. To take a packet to the next hop, it relies on a technology of link. On the other side, it knows nothing either about web pages or messages: it only carries bytes. This division of responsibilities is organized in layers, each using the services of the layer below:

The drawing looks like an hourglass. At the top, there are countless applications; at the bottom, dozens of technologies of transmission; at the neck, a single protocol. Any application works over any network, as long as both speak IP. When Wi‑Fi appeared, no application had to change, and when video calls appeared, no cable had to be replaced.

In practice, each layer wraps the data it receives from the layer above in a header of its own, in a process called encapsulation. Drag the slider to encapsulate a message:

The Ethernet frame also carries a field at its end, the FCS (Frame Check Sequence), a check for errors that covers the whole frame and is much stronger than the checksum of IP.

The frame is good for a single link. At each hop, the router removes the frame, examines the IP packet, decrements its TTL and puts it in a new frame, suited to the next link. The source and destination IP addresses stay the same from start to end, while the MAC addresses change at every hop. Drag the slider to follow the packet:

To build each frame, the MAC address of the next hop must be known. What bridges the two kinds of address is ARP (Address Resolution Protocol). The computer sends the whole local network a question like “who has the address 192.168.1.1?”, and only the owner of that address replies, giving its MAC. The answer is kept in a table for a few minutes, so that the question need not be asked again for every packet:

Scarcity and NAT

Four billion addresses were not enough. In February 2011, IANA, the body that coordinates their distribution worldwide, handed the last free blocks to the regional registries, which used up theirs in the years that followed; LACNIC handed out its last IPv4 addresses in August 2020. Today, whoever needs IPv4 addresses usually buys or rents them from someone who has some to spare.

The internet survived this thanks to a very successful patch. The private ranges that we saw on the map, such as 192.168.0.0/16, can be used by any internal network, repeated in millions of homes and companies, because they never appear on the public internet. Your phone, your laptop and your television probably have addresses like 192.168.1.20, and so do your neighbour's.

For these devices to reach the internet, the router at home does NAT (Network Address Translation). It swaps the private source address of each packet that goes out for its own public address and notes the swap in a table. When the reply comes back, it looks up the table and undoes the swap in the destination address. To tell different conversations apart, it also swaps the port, a number of 16 bits that TCP and UDP use to identify each conversation within a device. Use the buttons to start connections:

A side effect of NAT is that packets coming from outside with no conversation of theirs in the table have nowhere to go, and are discarded. This gives some protection, but it also gets in the way of applications that need to receive connections, such as online games and video calls, which resort to elaborate techniques to get round it. Many providers also apply a second level of NAT inside their own network, CGNAT, with the range 100.64.0.0/10, so that many customers share a single public address.

IPv6

The lasting solution to the scarcity is IPv6, specified in the 1990s. Its addresses have 128 bits, which gives 2¹²⁸ ≈ 3.4 × 10³⁸ addresses, about 340 undecillion. That is enough to give more than 600 sextillion addresses to every square metre of the surface of the Earth.

IPv6 addresses are written as eight groups of four hexadecimal digits separated by colons, as in 2001:0db8:0000:0000:0000:ff00:0042:8329. Since that is long, there are two rules for shortening it: the zeros at the left of each group can be left out, and one run of groups of zeros can be replaced by ::. The address above becomes 2001:db8::ff00:42:8329. Edit the address below or choose an example:

Usually, the first 64 bits identify the network, and the last 64 identify the device. A single local IPv6 network has 2⁶⁴ addresses, more than four billion times the size of the whole IPv4 internet.

The header was also redesigned. Switch between the two versions in the illustration below:

The IPv6 header has a fixed length of 40 bytes, and most of it is taken up by the two addresses. Several fields are gone. There is no checksum, because the layers of link and of transport already check for errors. Routers no longer fragment packets, a task left to the sender alone. The options moved to extension headers, chained by the field Next header, which replaced the field Protocol. The TTL came to be called Hop limit, which is what it always was in practice. And the new field Flow label marks the packets of one conversation. Notice also that the 32 bits of an IPv4 address fit at the end of an IPv6 address, as in the addresses ::ffff:192.0.2.10, used to represent IPv4 addresses within IPv6.

The transition is slow because the two versions are not compatible: a device that speaks only IPv4 cannot talk directly to one that speaks only IPv6. That is why most devices today use both at once, in an arrangement called dual stack. According to Google's measurements, IPv6 passed 50% of accesses for the first time in March 2026. Some countries got there years earlier, such as India, Germany and France.

Final words

IP is a modest protocol. It guarantees neither delivery nor order, does not know what it carries and remembers no packet once it has gone by. This modesty is precisely what made it universal. By asking so little of the networks below and promising so little to the applications above, it could be implemented in practically anything that sends bits, from satellites to smart light bulbs.

While this page was loading, dozens of packets crossed the way between a server and your device. At each router, an address was compared with a table, a counter was decremented and a sum was made again, without anyone having to plan the journey in advance. It is a simple idea, repeated billions of times a second on the scale of the planet.