I have 2 questions.
1) According to a lot of sources, when IP packets gets fragmented, in this case, lets take icmp, the icmp header is present only in the first packet.
But I have observed on some captures that, the icmp header has been attached to the last packet. Can anyone please correct me if I am wrong here?
I am attaching the source here: https://users.cis.fiu.edu/~vince/cgs4285/class13.html
The doc says its the first packet, but the pcap attached in the document shows the last packet of the 3 fragments has the icmp header. Am I missing something here?
2) In case of PMTU, when does PMTU discovery take place? How does the routers or devices know that the MTU is x bytes for x destination. And, what if the route it takes to the same destination changes the next time because of the link issues. Does it do the discovery again? Does the PMTUD take place before the ping.
Or does it happen on the fly, where lets say, I would like to visit a website. I start with the required size, lets say 500 bytes and the packet reaches the server. And then, the browser sends packets of varying sizes and then when one of the packets become too large for the path MTU, the client learns the Max size that it can send. And then, the client makes sure that the size doesnt exceed that PMTU. This happens for every or any destination that it wants to reach?