Here is a handy TCP/IP and tcpdump Reference card from the SANS institute: https://www.org/security-resources/tcpip.pdf Shown below is a simple...

Here is a handy TCP/IP and tcpdump Reference card from the SANS institute: https://www.sans.org/security-resources/tcpip.pdf

Shown below is a simple anomalous packet. An expensive automated tool could not parse it correctly, so I had to do it "by hand" using the reference above. Using the above reference and any other sources that you wish, analyze the following "normal", 20-byte IP Header. I recommend using calc.exe's "Programmer" mode to translate things like each octet of the source and destination addresses.