Correct : c,d

To determine which fields of an IP header are altered by an intermediate network layer device, let us analyze what happens inside an IP router during standard packet forwarding:
• a) Source IP Address:
The source IP address represents the original host that created and sent the packet. Standard routers do not change this address when forwarding packets (unless the router is explicitly performing Network Address Translation, or NAT, which is an optional service and not a core property of every standard router forwarding step).
→ Not always modified.

• b) Protocol:
The Protocol field (or Next Header field in IPv6) indicates the upper-layer transport protocol (like TCP or UDP) to which the payload data should be delivered at the final destination. This value must remain completely intact so the destination host can read the payload correctly.
→ Not always modified.

• c) Time to Live (TTL):
The TTL field is an 8-bit counter used to prevent routing loops where a packet circles endlessly in a network loop. Every single layer-3 router that processes a packet is required to decrement the TTL value by exactly 1 before forwarding it onwards. If the TTL reaches 0, the router drops the packet and sends an ICMP Time Exceeded message back to the source.
→ Always modified.

• d) Header Checksum:
The Header Checksum is used to detect errors inside the IP header fields. Because the TTL field is decremented at every router hop, the data bits within the header change at every hop. As a direct consequence, the router must recompute the entire validation value to match the updated header content before sending it out.
→ Always modified.
### Conclusion: The fields that are always modified by any router before forwarding are c and d.