| ip.addr | Source or Destination Address | IPv4 address | |
| ip.checksum | Header checksum | Unsigned 16-bit integer | |
| ip.checksum_bad | Bad Header checksum | Boolean | |
| ip.dsfield | Differentiated Services field | Unsigned 8-bit integer | |
| ip.dsfield.ce | ECN-CE | Unsigned 8-bit integer | |
| ip.dsfield.dscp | Differentiated Services Codepoint | Unsigned 8-bit integer | |
| ip.dsfield.ect | ECN-Capable Transport (ECT) | Unsigned 8-bit integer | |
| ip.dst | Destination | IPv4 address | |
| ip.flags | Flags | Unsigned 8-bit integer | |
| ip.flags.df | Don't fragment | Boolean | |
| ip.flags.mf | More fragments | Boolean | |
| ip.frag_offset | Fragment offset | Unsigned 16-bit integer | |
| ip.fragment | IP Fragment | No value | IP Fragment |
| ip.fragment.error | Defragmentation error | No value | Defragmentation error due to illegal fragments |
| ip.fragment.multipletails | Multiple tail fragments found | Boolean | Several tails were found when defragmenting the packet |
| ip.fragment.overlap | Fragment overlap | Boolean | Fragment overlaps with other fragments |
| ip.fragment.overlap.conflict | Conflicting data in fragment overlap | Boolean | Overlapping fragments contained conflicting data |
| ip.fragment.toolongfragment | Fragment too long | Boolean | Fragment contained data past end of packet |
| ip.fragments | IP Fragments | No value | IP Fragments |
| ip.hdr_len | Header Length | Unsigned 8-bit integer | |
| ip.id | Identification | Unsigned 16-bit integer | |
| ip.len | Total Length | Unsigned 16-bit integer | |
| ip.proto | Protocol | Unsigned 8-bit integer | |
| ip.src | Source | IPv4 address | |
| ip.tos | Type of Service | Unsigned 8-bit integer | |
| ip.tos.cost | Cost | Boolean | |
| ip.tos.delay | Delay | Boolean | |
| ip.tos.precedence | Precedence | Unsigned 8-bit integer | |
| ip.tos.reliability | Reliability | Boolean | |
| ip.tos.throughput | Throughput | Boolean | |
| ip.ttl | Time to live | Unsigned 8-bit integer | |
| ip.version | Version | Unsigned 8-bit integer | |