When I send the ICMP packet with data size as 4000B for testing the IP fragment.

ping -c1 -s4000

and the Wireshark captured it, enter image description here

enter image description here

Whether is is because of ICMP header? but we know ICMP header is 4 Bytes, how about the more 8 Bytes?

1 Answer 1


Simply because "we know ICMP header is 4 Bytes" is wrong. The ICMP header is 8 Bytes.

As you can see in RFC792 there's a fixed portion of 4 bytes, which contains the TYPE, CODE and CHECKSUM fields.

There's another 4 Bytes that contains different data depending of the ICMP message type (sometime unused).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.