Let's say we have a TCP or UDP message encapsulated in an IP packet. Let's say the length of the UDP/TCP message is too great for IP.
If I understood well the initial IP payload should be fragmented in several smaller packets. Hence the first IP packet has the TCP/UDP header and probably the beginning of the UDP/TCP payload. The second one has the next part of the UDP/TCP payload, and so on until the whole UDP/TCP message is sent. The port informations are contained in the UDP/TCP header.
Hence my question: does this mean we can't know the ports (both destination and source) of the fragmented messages ?
I think that yes, we can't know the port. But that is normal because we only need it at the UDP/TCP layer, that is complete once we rebuild it from the several IP packets. But I would like to check the number of packets by port coming through some point on a network. Is the only way to do this to catch the first packet, identify the ports and the IP ID field and to check for every IP ID field of every fragmented packet ?