IPv4 Options Format

The designers of IPv4 faced a fundamental challenge: how do you create a protocol flexible enough to accommodate features that haven't been invented yet, while keeping the base header efficient for the common case? Their solution was elegant—optional header extensions.

The IPv4 options field is a variable-length extension that follows the fixed 20-byte header. It enables advanced functionality like route recording, source routing, and timestamping without burdening every packet with rarely-used fields. Understanding options is essential for deep protocol analysis, network troubleshooting, and security assessment.

Before diving into the format details, let's understand where the options field sits within the IPv4 header and why it exists.

IPv4 Header Structure Recap:

The IPv4 header consists of two parts:

1. Fixed header (20 bytes): Contains essential fields like version, IHL, total length, TTL, protocol, source and destination addresses
2. Options field (0-40 bytes): Variable-length extension for additional functionality

The Internet Header Length (IHL) field indicates the total header size in 32-bit words. With a minimum value of 5 (20 bytes) and maximum of 15 (60 bytes), the options field can consume up to 40 bytes.

IPv4 options come in two distinct formats, distinguished by their structure:

1. Single-Byte Options (Type Only)

These options consist of just the 1-byte type field. They carry no additional data and are used for control purposes.

2. Multi-Byte Options (Type + Length + Data)

These options use a Type-Length-Value (TLV) structure:

• Type (1 byte): Identifies the option
• Length (1 byte): Total option size including type and length bytes
• Data (variable): Option-specific payload

The 1-byte type field is not merely an identifier—it's a carefully encoded structure with three distinct subfields:

  0   1   2   3   4   5   6   7
+---+---+---+---+---+---+---+---+
| C |Class| Number                |
+---+---+---+---+---+---+---+---+
|1b | 2b |      5 bits           |

Bit 0 - Copy Flag (C):

• 0: Option is NOT copied to all fragments during fragmentation
• 1: Option IS copied to every fragment

Bits 1-2 - Option Class:

• 00 (0): Control options
• 10 (2): Debugging and measurement options
• 01 (1) and 11 (3): Reserved for future use

Bits 3-7 - Option Number:

• Identifies the specific option within its class
• Provides space for 32 options per class

Decoding Example:

Let's decode option type value 137 (0x89 in hexadecimal):

1. Binary representation: 10001001
2. Copy flag (bit 0): 1 → Option is copied to all fragments
3. Class (bits 1-2): 00 → Control option
4. Number (bits 3-7): 01001 = 9 → Strict Source Routing

This encoding tells us that Strict Source Routing must be present in every fragment because routers along the path need routing instructions for each fragment they receive.

The length field in multi-byte options deserves careful attention because its interpretation differs from some other protocols.

Critical Point: Length Includes Type and Length Bytes

The length value indicates the total size of the option, including:

• 1 byte for the type field
• 1 byte for the length field itself
• Variable bytes for the data

Therefore:

• Minimum valid length is 2 (type + length, no data)
• Data payload size = Length - 2

The End of Options List (EOL) option, type value 0, is a single-byte option that marks the absolute end of the options area. After encountering EOL, no further option processing occurs—remaining bytes until the IHL-indicated header end are padding.

Key Characteristics:

• Type: 0 (binary: 00000000)
• Size: 1 byte
• Copy flag: 0 (not copied during fragmentation)
• Behavior: Terminates option parsing immediately

Usage Rules:

1. EOL is only required if options don't naturally end at a 32-bit boundary
2. After EOL, parsers ignore remaining bytes (treated as padding)
3. Unlike NOP, EOL indicates "no more options exist" rather than "skip this byte"

The No Operation (NOP) option, type value 1, is a single-byte padding option used to align subsequent options on specific boundaries.

Key Characteristics:

• Type: 1 (binary: 00000001)
• Size: 1 byte
• Copy flag: 0 (not copied during fragmentation)
• Behavior: Parser skips this byte and continues processing

Primary Uses:

1. Alignment: Align multi-byte options to 16-bit or 32-bit boundaries for efficient memory access
2. Separation: Insert visual separation between options in debugging output
3. Placeholder: Reserve space that might be filled later by intermediate devices

Options processing significantly impacts router performance and behavior. Unlike the fixed header fields, which can be processed in hardware at line rate, options require software handling and careful security consideration.

Processing Flow:

1. Detection: Router checks IHL field; if > 5, options are present
2. Parsing: Options area is scanned byte-by-byte
3. Interpretation: Each option is processed according to its type
4. Action: Router performs required actions (record address, follow route, etc.)
5. Forwarding: Packet continues with potentially modified options

Security Considerations:

IPv4 options have significant security implications:

1. Source Routing Abuse: Attackers can bypass firewall rules by specifying routes that avoid security devices
2. Reconnaissance: Record Route and Timestamp reveal network topology information
3. DoS Potential: Complex options processing can exhaust router CPU
4. Filtering Policies: Many enterprise and ISP networks now block packets with options

RFC 7126 (Internet Architecture Board) recommends filtering source-routed packets at network borders.