title: Strange IP packet analysis?
body: <p>I use tcpdump to catch some tcp packets, when analyzing them according to ip/tcp packet schema, the packet seems to be broken. Here is a sample packet I got from tcpdump output. Is any one familiar with them?</p>
  
  <p>Should not the first 4 bit of ip packet always be 0100 in under ipv4?</p>
  
  <p>ip packet: <a href="https://en.wikipedia.org/wiki/IPv4" rel="nofollow noreferrer">https://en.wikipedia.org/wiki/IPv4</a></p>
  
  <p>some examples: <a href="http://mike.passwall.com/networking/samplepacket.html" rel="nofollow noreferrer">http://mike.passwall.com/networking/samplepacket.html</a></p>
  
  <pre><code>13:11:43.330397 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
      172.16.0.14.16668 &gt; 36.24.146.114.64853: Flags [S.], cksum 0xdc0f (correct), seq 3029391223, ack 129060479, win 14480, options [mss 1460,sackOK,TS val 1254469916 ecr 1492278057,nop,wscale 6], length 0
          0x0000:  feee 809f 3247 5254 0054 aa9f 0800 4500  ....2GRT.T....E.
          0x0010:  003c 0000 4000 4006 d813 ac10 000e 2418  .&lt;..@.@.......$.
          0x0020:  9272 411c fd55 b490 d777 07b1 4e7f a012  .rA..U...w..N...
          0x0030:  3890 dc0f 0000 0204 05b4 0402 080a 4ac5  8.............J.
  </code></pre>
  
  <pre class="lang-sh prettyprint-override"><code>uname -a
  # Linux VM_0_14_centos 2.6.32-754.2.1.el6.x86_64 #1 SMP Fri Jul 13 12:50:12 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
  
  # tcpdump
  tcpdump tcp -vv -XX -n -i eth0 port 16668
  </code></pre>