From RFC2460 :https://www.rfc-editor.org/rfc/rfc2460#section-4.5, the length of the fragment header seems to be fixed 8 bytes.

But when I test with Scapy with the default fragment header, from sniffer I can see the fragment header is for one byte? That is the data generated by Scapy seems not consistent with the specification?

I'm not sure in the real world, what will this header will be designed?

1 Answer 1


You question is confusing. The fragmentation header is 8 bytes. You say the observed payload is 1 byte. The payload is not the header, and the size of the header has nothing to do with the size of the payload.

Edit based on your comment and correction of the the question:

The fragmentation header is 8 bytes. You may be reading the results incorrectly, or it is possible that the application you are using doesn't correctly understand what it is seeing.

  • thanks Ron. I fix my word. I observe the header length is just one byte. I just wonder if the header length is wrong, why sniffer still can recognize it? Oct 1, 2015 at 15:39
  • How did you determine that the observed header is only 1 byte? It is possible that the other fields in the header are all 0. I think you are reading it incorrectly, or your application is confused.
    – Ron Maupin
    Oct 1, 2015 at 15:41
  • Indeed.. I must be tired.. I misread the output of sniffer... Thanks for your kindly reply~~~~ Oct 1, 2015 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.