When I send the ICMP packet with 4000B, but the IPv4 segment calculated 4008B

Question

When I send the ICMP packet with data size as 4000B for testing the IP fragment.

ping 192.168.2.1 -c1 -s4000

and the Wireshark captured it,

---

Whether is is because of ICMP header? but we know ICMP header is 4 Bytes, how about the more 8 Bytes?

Answer 1

Simply because "we know ICMP header is 4 Bytes" is wrong. The ICMP header is 8 Bytes.

As you can see in RFC792 there's a fixed portion of 4 bytes, which contains the TYPE, CODE and CHECKSUM fields.

There's another 4 Bytes that contains different data depending of the ICMP message type (sometime unused).