Source: tcpdump -X -c 1 -i eth0 · One packet, fully self-contained
0000 d4 6e 0e ab 12 a3 b8 27 eb 12 34 56 08 00 45 00 0010 00 3c 1a 4f 40 00 40 11 a3 c1 c0 a8 01 0a 08 08 0020 08 08 d3 7b 00 35 00 28 5b 9d 12 34 01 00 00 01 0030 00 00 00 00 00 00 07 65 78 61 6d 70 6c 65 03 63 0040 6f 6d 00 00 01 00 01
| Layer | Starts at byte | Key fields |
|---|---|---|
| Ethernet | 0 | EtherType at offset 12 (2 bytes). 0800=IPv4 |
| IPv4 | 14 | Protocol byte at offset 23. Src IP at 26-29, Dst IP at 30-33 |
| Transport | 14 + IHL×4 | Src port (2 bytes), Dst port (2 bytes), … |
0x06 = TCP0x11 = UDP0x01 = ICMP