IPX Header Structure

The IPX header, which comes immediately after media and Data Link Layer headers (such as Ethernet, Token Ring, or Point-to-Point Protocol [PPP]), is shown in Figure 5.2.


Figure 5.2 IPX Header

Checksum    A 16-bit checksum on the IPX header and its payload is typically unused. If unused, the Checksum field is set to 0xFF-FF . If the Checksum is used, the IPX node cannot be configured to use the ETHERNET_802.3 frame type.

Length    The length field indicates the length of the IPX packet (IPX header and IPX payload) in bytes. To accommodate older routers and network adapters, sometimes an IPX node must be configured to ensure that the IPX packet is an even number of bytes. If the packet contains an odd number of bytes, an extra byte is used to fill out the packet to an even number of bytes. The extra byte is not included in the Length field.

Transport Control    The Transport Control field indicates the number of IPX routers that have processed the IPX packet, known as the hop count. Sending nodes set this field to zero, and it is incremented by one by each IPX router in the path from the source to the destination. RIP for IPX routers limit the maximum number of routers in a network path to 16. At the 17th RIP for IPX router, the IPX packet is discarded by the router without notifying the sending node, known as a silent discard. NetWare Link Services Protocol (NLSP) for IPX routers can support a hop count of up to 127.

Packet Type    The Packet Type field indicates the contents of the payload portion of the IPX packet. It allows a number of client protocols to use IPX and be identified by the IPX router. Table 5.1 lists some common defined values of the IPX Packet Type.

Table   5.1 IPX Packet Type Values

Client Protocol

Packet Type (Hexadecimal)





SAP/Normal IPX




IPX WAN Broadcast (used for NetBIOS over IPX Broadcasts)

14 (20 in decimal)

Routers can filter out IPX traffic based on the Packet Type field. For example, some routers by default do not propagate NetBIOS over IPX Broadcast traffic and must be manually configured to enable packets with a packet type value of 20.

Network (Destination and Source)    The Destination Network and Source Network fields each identify the network (a segment of the IPX internetwork bounded by IPX routers) to which an IPX node is connected. IPX network numbers are a flat addressing space. No subnetting (the subdivision of network IDs) or summarization of groups of IPX networks is possible with RIP for IPX routing. RIP for IPX routers must have a route to each network number in their routing tables. All IPX networks must be given a unique IPX network number.

Node (Destination and Source)    The Destination Node and Source Node fields each identify a node on an IPX network. The 6-byte fields can be used to store physical addresses — also known as Media Access Control (MAC) addresses.

Socket (Destination and Source)    The Destination Socket and Source Socket fields identify the software process addresses of the destination and source applications respectively. With multiple processes communicating between the same two computers, the IPX Network and Node numbers are the same. The IPX Socket number is a software process identifier that is used to forward the IPX payload to the proper process.

Many socket numbers are well known. For example, the file server process running on Novell NetWare or compatible file servers uses the well-known socket address of 0x451. Any requests to socket 0x451 on the NetWare file server are forwarded to the NetWare file server process. NetWare file server clients and IPX applications that do not use a well-known socket number use dynamically allocated socket numbers. Table 5.2 lists some common, defined values for IPX socket numbers.

Table   5.2 IPX Socket Numbers


Socket Number (Hexadecimal)

NCP Server










The IPX socket is not the same as a socket in the Windows Sockets 2. x API (Winsock). A socket in Winsock is a generalized process endpoint. A TCP/IP-based Winsock socket is a combination of the IP Address and port number that identifies a process endpoint on an IP internetwork. An IPX-based Winsock socket is a combination of the IPX Network, IPX Node, and IPX Socket numbers that identifies a process endpoint on an IPX internetwork.