1

Would a ping (echo request) to a reachable IP address with a size of 65500 bytes, end-to-end path MTU of 1500 Bytes, and the DF flag not set, work by having the peer responding an ICMP?

21:05:31.325718 IP (tos 0x0, ttl 128, id 18761, offset 0, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: ICMP echo request, id 1, seq 28, length 1480
21:05:31.325726 IP (tos 0x0, ttl 128, id 18761, offset 1480, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325729 IP (tos 0x0, ttl 128, id 18761, offset 2960, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325732 IP (tos 0x0, ttl 128, id 18761, offset 4440, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325734 IP (tos 0x0, ttl 128, id 18761, offset 5920, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325736 IP (tos 0x0, ttl 128, id 18761, offset 7400, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325739 IP (tos 0x0, ttl 128, id 18761, offset 8880, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325742 IP (tos 0x0, ttl 128, id 18761, offset 10360, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325743 IP (tos 0x0, ttl 128, id 18761, offset 11840, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325746 IP (tos 0x0, ttl 128, id 18761, offset 13320, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325747 IP (tos 0x0, ttl 128, id 18761, offset 14800, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325750 IP (tos 0x0, ttl 128, id 18761, offset 16280, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325752 IP (tos 0x0, ttl 128, id 18761, offset 17760, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325754 IP (tos 0x0, ttl 128, id 18761, offset 19240, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325756 IP (tos 0x0, ttl 128, id 18761, offset 20720, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325758 IP (tos 0x0, ttl 128, id 18761, offset 22200, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325760 IP (tos 0x0, ttl 128, id 18761, offset 23680, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325762 IP (tos 0x0, ttl 128, id 18761, offset 25160, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325764 IP (tos 0x0, ttl 128, id 18761, offset 26640, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325767 IP (tos 0x0, ttl 128, id 18761, offset 28120, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325769 IP (tos 0x0, ttl 128, id 18761, offset 29600, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325771 IP (tos 0x0, ttl 128, id 18761, offset 31080, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325774 IP (tos 0x0, ttl 128, id 18761, offset 32560, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325776 IP (tos 0x0, ttl 128, id 18761, offset 34040, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325778 IP (tos 0x0, ttl 128, id 18761, offset 35520, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325781 IP (tos 0x0, ttl 128, id 18761, offset 37000, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325786 IP (tos 0x0, ttl 128, id 18761, offset 38480, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325788 IP (tos 0x0, ttl 128, id 18761, offset 39960, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325789 IP (tos 0x0, ttl 128, id 18761, offset 41440, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325791 IP (tos 0x0, ttl 128, id 18761, offset 42920, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325793 IP (tos 0x0, ttl 128, id 18761, offset 44400, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325794 IP (tos 0x0, ttl 128, id 18761, offset 45880, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325796 IP (tos 0x0, ttl 128, id 18761, offset 47360, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325798 IP (tos 0x0, ttl 128, id 18761, offset 48840, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325800 IP (tos 0x0, ttl 128, id 18761, offset 50320, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325801 IP (tos 0x0, ttl 128, id 18761, offset 51800, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325803 IP (tos 0x0, ttl 128, id 18761, offset 53280, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325805 IP (tos 0x0, ttl 128, id 18761, offset 54760, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325807 IP (tos 0x0, ttl 128, id 18761, offset 56240, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325808 IP (tos 0x0, ttl 128, id 18761, offset 57720, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325810 IP (tos 0x0, ttl 128, id 18761, offset 59200, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325812 IP (tos 0x0, ttl 128, id 18761, offset 60680, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325814 IP (tos 0x0, ttl 128, id 18761, offset 62160, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325816 IP (tos 0x0, ttl 128, id 18761, offset 63640, flags [+], proto ICMP (1), length 1500)
    1.1.1.2 > 1.1.1.1: icmp
21:05:31.325818 IP (tos 0x0, ttl 128, id 18761, offset 65120, flags [none], proto ICMP (1), length 408)
    1.1.1.2 > 1.1.1.1: icmp
Improve this question
0

2 Answers 2

Reset to default
2

A ping with a packet size much larger than the MTU will succeed, but only if fragmentation is allowed, and all the fragments reach the target and can be reassembled into the original ICMP packet.

Any packet (ICMP or otherwise) larger than the smallest MTU in the path with the DF bit set will fail to get to the other end.

Improve this answer
4
  • Thanks,as you can see from the output all fragments sent are smaller than the MTU and the DF is not set. would a ping 8.8.8.8 -l 65500 -n 1 work?
    – Dense.mode
    Jul 14, 2016 at 21:20
  • 2
    If fragmentation is allowed, and all the fragments arrive (none are dropped due to congestion or as attack prevention), then the ping should work. The problem is that you will have a lot of fragments, some routers will drop fragments, and ICMP is a very low priority and is likely to have packets dropped when there is any congestion. In theory, it will work, but everything must be just right.
    – Ron Maupin ♦
    Jul 14, 2016 at 21:25
  • 1
    Thank you Ron, I also thought it was going to work, but I found that there is an imposed limit of 65468 by one of our firewalls to prevent ping of death: en.wikipedia.org/wiki/Ping_of_death Most end hosts should have no problem with dealing with this, but older hosts/unpatched ones could potential end up having IP stack overflow and crashing the box. This is not due to ICMP protocol itself; This is due to the re-assembled packet exceeding the max IP size of 65535.
    – Dense.mode
    Jul 15, 2016 at 17:00
  • 1
    This sort of thing is one of the tests we run on new PE/CE circuits. We ping the PE from the CE with a huge packet size for 10,000 repetitions. If any pings fail, we get the carrier involved to fix the circuit. This is not something I would try to do over multiple hops.
    – Ron Maupin ♦
    Jul 15, 2016 at 17:12
0

there is an imposed limit of 65468 by one of our firewalls to prevent ping of death: en.wikipedia.org/wiki/Ping_of_death Most end hosts should have no problem with dealing with this, but older hosts/unpatched ones could potential end up having IP stack overflow and crashing the box. This is not due to ICMP protocol itself; This is due to the re-assembled packet exceeding the max IP size of 65535

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.