IP fragmentation and PMTUD

Question

I have 2 questions.

1) According to a lot of sources, when IP packets gets fragmented, in this case, lets take icmp, the icmp header is present only in the first packet.

But I have observed on some captures that, the icmp header has been attached to the last packet. Can anyone please correct me if I am wrong here?

I am attaching the source here: https://users.cis.fiu.edu/~vince/cgs4285/class13.html

The doc says its the first packet, but the pcap attached in the document shows the last packet of the 3 fragments has the icmp header. Am I missing something here?

2) In case of PMTU, when does PMTU discovery take place? How does the routers or devices know that the MTU is x bytes for x destination. And, what if the route it takes to the same destination changes the next time because of the link issues. Does it do the discovery again? Does the PMTUD take place before the ping.

Or does it happen on the fly, where lets say, I would like to visit a website. I start with the required size, lets say 500 bytes and the packet reaches the server. And then, the browser sends packets of varying sizes and then when one of the packets become too large for the path MTU, the client learns the Max size that it can send. And then, the client makes sure that the size doesnt exceed that PMTU. This happens for every or any destination that it wants to reach?

Answer 1

1. The ICMP header is at the beginning of an IP packet. Since fragmentation doesn't change the IP packet itself, the header needs to be present in the first fragment. Whatever you think you've seen must've been something else.

2. PMTUD works by setting the DF bit in IPv4 packets (for IPv6 this is implied). That way, any hop being unable to forward the packet due to link layer limitation returns an ICMP Fragmentation Needed to the source. The source adjust its path MTU for that destination and retries. Normally, the path MTU doesn't change in the middle of a conversation, but the actual PMTU might not be discovered right away, so it's pretty much on the fly.