ICMP and IP headers

[rathinilesh]

Hi,

When I try to ping a directly connected router with a "size" ot 2000, I see two fragments. The 1st fragment is 1500 bytes and the 2nd fragment is 520 byes. Some "googling" revealed that the IPv4 header is 20 bytes while an ICMP header is 8 bytes and starts after the IPv4 header which makes the total header size = 28 bytes.

Thus the total bytes sent should be =  2000 data + (2 x 28) headers = 2056 but actually the total bytes sent is 2020(2 fragments) which makes me think of the below reasons

1. the "size" option in the ping includes the associated header size AND

2. there are no added ICMP headers.

Could somebody please clarify ?

Regards,

Nilesh

[Giuseppe Larosa]

Hello Nilesh,

the second fragment has only the IPv4 header, ICMP header is not replicated on it as this is not necessary.

Both packets have settings to indicate they are fragments (DF bit is set) and first fragment has the M ( more fragments to follow ) bit set.

Both packets share an identification field and have a specific Fragment Offset field to indicate their position in the original packet.

All the flag bits DF, M and the identification field and fragment offset are enough to allow packet reassembly at final destination so for this reason the ICMP header is not replicated on the second fragment.

see

http://tools.ietf.org/html/rfc791

A 20 byte IPv4 header is present in the second segment so the total IP size of second fragment is 520 bytes and not 500 bytes.

On cisco routers the ping size is that of the whole packet including payload and headers but fragmentation adds an IPv4 header in your case.

Hope to help

Giuseppe

[rathinilesh]

Hi Guiseppe,

Thank you for your reply. I had a clear picture of the flag bits in my mind but was confused about the ICMP header in the two fragments.Thus I did a packet capture which revealed that the ICMP header is only added to the last fragment and not all fragments.

Regards,

Nilesh