🔄 Topic

The networking module introduced the fields inside IPv4 and IPv6 packets. The diagrams looked simple until I tried to connect them to a real Wireshark frame. That connection matters because network security analysis depends on understanding what the header can tell me and what it cannot.

🎯 Goal

Learn to recognise the purpose of the important IP-header fields, then use Wireshark's decoded view to locate the corresponding evidence in a packet.

🛠 What I Studied

For IPv4, I focused on the version, header length, total length, identification, flags, fragment offset, time to live, protocol, header checksum, source address, and destination address. These fields describe how the packet should be interpreted, how large it is, whether fragmentation is involved, how long it may remain in the network, and which transport protocol follows it.

For IPv6, I compared the more streamlined header: version, traffic class, flow label, payload length, next header, hop limit, source address, and destination address. The names are different in places, but the analyst's question is similar: what is this packet, where is it going, how should the next protocol be decoded, and what routing or lifetime information is visible?

In Wireshark, I selected a packet and expanded the Internet Protocol Version 4 section. The decoded view exposed the source and destination addresses, protocol value, time to live, total length, and fragmentation flags. That was more useful than memorising a diagram because every field was connected to a real frame in the sample capture.

🧠 What I Learned

Headers are metadata, but metadata can be valuable security evidence. A source address can help associate traffic with an asset. A destination and protocol can help define the communication. A low or unusual time-to-live value can be a clue during troubleshooting or traffic comparison. Fragmentation fields can explain why a payload is split across frames and can also deserve attention in defensive analysis.

None of those fields identifies an attacker on its own. Addresses can be translated, spoofed, shared, or belong to infrastructure that I do not control. The header gives me a structured starting point; identity and intent still require other evidence.

The biggest improvement in my learning was changing the question from “What does every box mean?” to “Which boxes answer the investigation question I have?”

⚠️ Limitations

The IPv4 and IPv6 comparison was a learning exercise based on course diagrams and the supplied Wireshark capture. I did not capture traffic from a live network, attribute the sample endpoints to real people, or infer malicious activity from the addresses.

✅ Takeaway

Reading packet headers is a form of disciplined observation. Before filtering or escalating traffic, I should know which fields I am using, what they establish, and where the boundary between network fact and security interpretation begins.