Wireshark Fundamentals by Unknown

Author:Unknown
Language: eng
Format: epub

Chapter 3 analyzing layer 2 and layer 3 traffiC

Figure 3-18. Wireshark capture of last fragmented packet For simplicity and ease of remembering, the IP packets can be

categorized into three types:

• Nonfragmented

• Initial fragment

• Noninitial fragment

Based on these packet types, the more fragments bit and Fragment Offset field are set as shown in Table 3-5.

109

Chapter 3 analyzing layer 2 and layer 3 traffiC

Table 3-5. Fragment Settings in IP Header

Packet Type

More Fragments Flag

Fragment Offset Field

nonfragmented

0

0

initial fragment

1

0

noninitial fragment (not last)

1

nonzero

noninitial fragment (last)

0

nonzero

In today’s networks, we rarely notice fragmentation as most networks these days are designed with support for jumbo MTU (MTU values higher than 1500 bytes). All the Gigabit Ethernet networks support up to 9216

bytes to be set as the MTU value and to leverage the benefit of higher MTU sizes, most applications send the packets with the don’t fragment (do not fragment or DF) bit set. When this bit is set, the router processing the packet will not fragment the packet and will try to send the packet out as is. When a packet is forwarded across a network segment with the DF bit set and the router encounters a next hop interface having lower MTU or IP MTU settings, the router will send an ICMP Destination Unreachable message back with type 3 and code 4, which basically means fragmentation is needed and the DF bit is set. Along with the ICMP Destination Unreachable message, the router also sends the MTU

settings of the next hop device to let the source know that it needs to send the packet with a smaller data payload if it wants to send the packet with the DF bit set. Figure 3-19 displays the Wireshark capture of the ICMP

Destination Unreachable message along with the MTU settings of the next hop device.

110

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.