When I send the ICMP packet with data size as 4000B
for testing the IP fragment.
ping 192.168.2.1 -c1 -s4000
and the Wireshark captured it,
Whether is is because of ICMP header? but we know ICMP header is 4 Bytes, how about the more 8 Bytes?
Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this communitySimply because "we know ICMP header is 4 Bytes" is wrong. The ICMP header is 8 Bytes.
As you can see in RFC792 there's a fixed portion of 4 bytes, which contains the TYPE, CODE and CHECKSUM fields.
There's another 4 Bytes that contains different data depending of the ICMP message type (sometime unused).