| ip.addr | Source or Destination Address | IPv4 address |
| ip.checksum | Header checksum | Unsigned 16-bit integer |
| ip.checksum_bad | Bad Header checksum | Boolean |
| ip.dsfield | Differentiated Services field | Unsigned 8-bit integer |
| ip.dsfield.ce | ECN-CE | Unsigned 8-bit integer |
| ip.dsfield.dscp | Differentiated Services Codepoint | Unsigned 8-bit integer |
| ip.dsfield.ect | ECN-Capable Transport (ECT) | Unsigned 8-bit integer |
| ip.dst | Destination | IPv4 address |
| ip.flags | Flags | Unsigned 8-bit integer |
| ip.flags.df | Don't fragment | Boolean |
| ip.flags.mf | More fragments | Boolean |
| ip.frag_offset | Fragment offset | Unsigned 16-bit integer |
| ip.fragment | IP Fragment | No value |
| ip.fragment.error | Defragmentation error | No value |
| ip.fragment.multipletails | Multiple tail fragments found | Boolean |
| ip.fragment.overlap | Fragment overlap | Boolean |
| ip.fragment.overlap.conflict | Conflicting data in fragment overlap | Boolean |
| ip.fragment.toolongfragment | Fragment too long | Boolean |
| ip.fragments | IP Fragments | No value |
| ip.hdr_len | Header Length | Unsigned 8-bit integer |
| ip.id | Identification | Unsigned 16-bit integer |
| ip.len | Total Length | Unsigned 16-bit integer |
| ip.proto | Protocol | Unsigned 8-bit integer |
| ip.src | Source | IPv4 address |
| ip.tos | Type of Service | Unsigned 8-bit integer |
| ip.tos.cost | Cost | Boolean |
| ip.tos.delay | Delay | Boolean |
| ip.tos.precedence | Precedence | Unsigned 8-bit integer |
| ip.tos.reliability | Reliability | Boolean |
| ip.tos.throughput | Throughput | Boolean |
| ip.ttl | Time to live | Unsigned 8-bit integer |
| ip.version | Version | Unsigned 8-bit integer |