2

Given, for example, a Wireshark trace, how can I identify that the IP fragments that I am sending are themselves being fragmented?

For example, if I'm sending 1500 byte IP fragments, and the server is responding with 1460 byte fragments, is that a reasonably good indicator that there's a link somewhere that's fragmenting my packets further?

Improve this question
3
  • What you you mean 1500 byte fragments? Fragments must be a multiple of eight bytes. 1500 is a typical packet size because that is the ethernet MTU. If you run into a tunnel or something that has a smaller MTU, and the DF flag is not set, then a router will fragment the packets. The fragments may be further fragmented if there is a different MTU later along the path that is smaller than the largest fragment, which probably results in the fragments of the original packet being various sizes. Fragments will be the same size (except the last) unless further fragmented.
    – Ron Maupin ♦
    Commented Nov 9, 2019 at 15:47
  • 1
    The answer to this question demonstrates fragmentation, then further fragmentation. If there are only two fragments per packet, it was obviously only fragmented once, but even with s single fragmentation, you could end up with more than two fragments per packet, all of which are the same size, except the last fragment.
    – Ron Maupin ♦
    Commented Nov 9, 2019 at 15:50
  • Possible duplicate of Calculating Fragmentation offset doubt
    – Zac67 ♦
    Commented Nov 9, 2019 at 17:39

1 Answer 1

Reset to default
0

The packet you send from you host will, in all likelihood, not be fragmented before being sent, so 1500 byte packets are pretty normal. If the MTU on a link in the path shrinks, The router will fragment the packet, as long as the DF (Do Not Fragment) flag is not set on the packet, and a router needing to fragment a packet with the DF flag set will drop the packet (possibly sending back an ICMP message to the source). Certainly, if the DF flag is set when the packet reaches the destination, the packet was not fragmented. From the receiving side, to tell if a packet has been fragmented, you look at the Identification field, the MF (More Fragments) flag, and the Fragment Offset field.

If all but the last fragment are the same size, it is likely that the packet was only fragmented once, even if there are multiple fragments. Fragmentation will try to make all the fragments as large as possible (the payload must be of a size evenly divisible by eight), but the last fragment will be whatever is left over. Fragmenting a fragment will be the same way, so you will likely have a smaller (last fragment of the last fragmentation) fragment mixed into the string of fragments if the packet has been fragmented more than once. It is possible, but unlikely, that a packet fragmented more than once has all the fragments but the last the same size.

In any case, it really does not matter how many times the packet was fragmented because the reassembly procedure is the same, regardless of how many fragments or how many times the packet was fragmented.

Many routers and firewalls are now configured to drop packet fragments due to fragmentation attacks that can tie up resources in the destination host. We can also use PMTUD to discover the smallest MTU in the path, and adjust the packet size prior to sending a packet so that it does not get fragmented along the path. Fragmenting packets is resource intensive for routers, so IPv6 does not allow routers to fragment packets, and you must use PMTUD with IPv6 to set the size of the packets such that the packets fit the smallest MTU in the path to a destination.

The answers to this question explain and demonstrate fragmentation, then further fragmentation.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.