I am currently experimenting which Tunnelshell. So, I launched it on the victim and on the attacker, executed a command via the Tunnelshell and captured the traffic via Wireshark to see what's going on under the hood. To my knowledge, all fragments must carry its offset in the original unfragmented packet to ensure that they can be reassembled on the destination host. However, as you can see in the following screenshot:
they all have the same offset. In addition, all fragments, except the last one, must have the "More Fragments" flag set, but I can't find that either in any of the fragmented packets. Instead, the flag "Don't fragment" is set:
How can they be successfully reassembled on the attacker's host?