Difference between struct ip and struct iphdr

Question

I am trying to understand how the network is working, i'm doing some test, sending some package... anyway

My point is that i can't find the real difference between "protocol" structure and "protocol header" structure.

For the ip structure, they both sized 20 bytes. but for exemple:

• struct ip and struct iphdr sized 20 bytes
• struct icmp sized 28 bytes
• struct icmphdr sized 8 bytes

I'm guessing that the struct icmp include a struct ip/iphdr? ?

And there is the same kind of structure with every protocol i have seen. struct udp / struct udphdr,

Is it link to IP_HDRINCL set on with setsockopt() ?

So my question is What is the real difference between them ? And When use the good one.

ip and iphdr struct:

struct iphdr {
    #if defined(__LITTLE_ENDIAN_BITFIELD)
        __u8    ihl:4,
                version:4;
    #elif defined (__BIG_ENDIAN_BITFIELD)
        __u8    version:4,
                ihl:4;
    #else
        #error  "Please fix <asm/byteorder.h>"
    #endif
         __u8   tos;
         __u16  tot_len;
         __u16  id;
         __u16  frag_off;
         __u8   ttl;
         __u8   protocol;
         __u16  check;
         __u32  saddr;
         __u32  daddr;
         /*The options start here. */
};

And IP HDR

struct ip {
#if BYTE_ORDER == LITTLE_ENDIAN 
    u_char  ip_hl:4,        /* header length */
        ip_v:4;         /* version */
#endif
#if BYTE_ORDER == BIG_ENDIAN 
    u_char  ip_v:4,         /* version */
        ip_hl:4;        /* header length */
#endif
    u_char  ip_tos;         /* type of service */
    short   ip_len;         /* total length */
    u_short ip_id;          /* identification */
    short   ip_off;         /* fragment offset field */
#define IP_DF 0x4000            /* dont fragment flag */
#define IP_MF 0x2000            /* more fragments flag */
    u_char  ip_ttl;         /* time to live */
    u_char  ip_p;           /* protocol */
    u_short ip_sum;         /* checksum */
    struct  in_addr ip_src,ip_dst;  /* source and dest address */
};

ICMP structure code here : https://www.cymru.com/Documents/ip_icmp.h

Answer 1

struct ip and struct iphdr are two different definitions of the same underlying structure, brought in from different places.

struct ip is defined in <netinet/ip.h>, which is a reasonably standard header on UNIX systems.

struct iphdr is defined in <linux/ip.h>. This header (and structure) are Linux-specific, and will not be present in other operating systems.

If you're not sure which one to use, use struct ip; code which uses this structure is more likely to be portable to non-Linux systems.

---

struct icmp and struct icmphdr are a messier situation:

• <netinet/icmp.h> defines both struct icmp and struct icmphdr.
• <linux/icmp.h> also defines struct icmphdr, with a similar structure (but, as usual, different field names) as the definition from <netinet/icmp.h>.

First: Don't include <linux/icmp.h> unless you have a very good reason. You cannot include both headers -- they will conflict -- and most software will expect the netinet definition.

Second: struct icmphdr is, as the name implies, the header. struct icmp defines the contents of a structured ICMP message, like a destination unreachable message.