When I send the ICMP packet with data size as
4000B for testing the IP fragment.
ping 192.168.2.1 -c1 -s4000
and the Wireshark captured it,
Whether is is because of ICMP header? but we know ICMP header is 4 Bytes, how about the more 8 Bytes?
Stack Exchange network consists of 181 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.Visit Stack Exchange
Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.Sign up to join this community
Simply because "we know ICMP header is 4 Bytes" is wrong. The ICMP header is 8 Bytes.
As you can see in RFC792 there's a fixed portion of 4 bytes, which contains the TYPE, CODE and CHECKSUM fields.
There's another 4 Bytes that contains different data depending of the ICMP message type (sometime unused).