question about forwarding fragmented ip packets

[maxim.alyakin]

Hi all!

I'm trying to understand how routers/l3 switches process  IP packet, when it consist of 2 or more ethernet frames.

For exapmle let it be the 2000 bytes ICMP packet, as I understand the IP SA/DA there only in first frame, so how does L3 device decide where to send the 2nd frame, if it don't contains IP address and nothing from IP header (correct me if im wrong)? Does it reassembly frames in buffer and forward packet only when all parts (frames) completely reveived?

Because everythere written what: "IP Reassembly processing at the Receiving End System" (Or this is about IP fragmenting when MTU mismatch happening along the path?)

I draw a scheme for myself, is it correct? (im confused with wireshark - it doesn't show frames separately)

[Joseph W. Doherty]

Disclaimer

The  Author of this posting offers the information contained within this  posting without consideration and with the reader's understanding that  there's no implied or expressed suitability or fitness for any purpose.  Information provided is for informational purposes only and should not  be construed as rendering professional advice of any kind. Usage of this  posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of  use, data or profit) arising out of the use or inability to use the  posting's information even if Author has been advised of the possibility  of such damage.

Posting

IP fragments contain a (copied although modified [indicates it's an IP fragment]) IP header, so they are routed normally.

PS:

Wireshark is showing the original IP packet reassembled from the fragments.

[Giuseppe Larosa · Accepted solution]

Hello Maxim,

>> as I understand the IP SA/DA there only in first frame, so how does L3 device decide where to send the 2nd frame, if it don't contains IP address and nothing from IP header

IP fragments are still IP packets and each of them have an IPv4 header so all fragments can be routed to the final destination where packet reassembly takes place. Only the upper layer protocol headers like TCP or UDP are not copied to the second fragment.

IP fragmentation happens at OSI layer3 and produces multiple IP fragment packets

Hope to help

Giuseppe

[maxim.alyakin]

Joseph, thanks for your reply!

Giuseppe, thanks for detailed explanation!

I was confused with number of bytes in brackets:

:~$ ping 192.168.100.1 -s 2000

PING 192.168.100.1 (192.168.100.1) 2000(2028) bytes of data.

2028 = 2000 (ICMP payload) + 20 (IP header) + 8 (ICMP header)

so in fact there are 2028+20 (2048) bytes of data?

[Giuseppe Larosa]

Hello Maxim,

yes there is an additional 20 bytes for the IPv4 header of the second fragment

the second packet has size 548 byte and an offset of 1480 octets you can see this in the wireshark capture jpeg image.

Hope to help

Giuseppe