Let's say we have a TCP or UDP message encapsulated in an IP packet. Let's say the length of the UDP/TCP message is too great for IP.

If I understood well the initial IP payload should be fragmented in several smaller packets. Hence the first IP packet has the TCP/UDP header and probably the beginning of the UDP/TCP payload. The second one has the next part of the UDP/TCP payload, and so on until the whole UDP/TCP message is sent. The port informations are contained in the UDP/TCP header.

Hence my question: does this mean we can't know the ports (both destination and source) of the fragmented messages ?

I think that yes, we can't know the port. But that is normal because we only need it at the UDP/TCP layer, that is complete once we rebuild it from the several IP packets. But I would like to check the number of packets by port coming through some point on a network. Is the only way to do this to catch the first packet, identify the ports and the IP ID field and to check for every IP ID field of every fragmented packet ?

1 Answer 1


That is correct. IP fragments will contain only IP fields. The TCP/UDP header will be in the first fragment only. So, you'd have to collect the entire frame (from all the fragments) to apply any L4 rules to it, or track the entire session to apply the same rule to all the fragments. Cisco calls this virtual fragment reassembly. Some/Many firewalls simply don't bother, and instead block all fragments. ("it's the only way to be sure" :-))

(FWIW, all my routers/firewalls are explicitly configured to drop fragments. If you cannot do PMTUd correctly, I have no desire to talk to you.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.