This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello!

I have set the MTU to 1400 on computer "A".

From computer "B" I ping computer "A" by sending a 2000 bytes large ICMP packets:

ping -s 2000 192.168.0.10

I don't get any replies from computer "A". Wireshark detects fragmented IP packets with the info "proto=ICMP 0x01, off=1480", but no ICMP packets.

If I change the MTU to 1500 on computer "A", then packets of any size are sent over from computer "B" to computer "A" and are fragmented.

Why does it work with MTU=1500 but not with MTU=1400?

asked 02 Feb '11, 01:31

Rox's gravatar image

Rox
217810
accept rate: 0%


Computer B will send IP datagrams of up to 1480 bytes (assuming the IP header is 20 bytes). The rest of the ICMP packet (with a payload of 2000 bytes) will be sent in a second fragment. This can be verified by the fact that you see "proto=ICMP 0x01, off=1480".

The first IP fragment is 1500 bytes on the wire. However, Computer A was told it can only send/receive packets of up to 1400 bytes. Therefor it drops the first IP fragment of this IP datagram and only receives the second fragment with the offset of 1480.

When you change the MTU size on a system, you need to change it for all directly connected systems on the network.

permanent link

answered 02 Feb '11, 10:52

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

edited 02 Feb '11, 14:20

SYNbit is dead on. Your machine is not most likely not sending packets that are greater than 1500 bytes. Add the -f to your ping command to set the df bit.

C:Documents and Settingspaul>ping -f -n 2 -l 2000 192.168.0.1

Pinging 192.168.0.1 with 2000 bytes of data:

Packet needs to be fragmented but DF set.

Packet needs to be fragmented but DF set.

Ping statistics for 192.168.0.1: Packets: Sent = 4, Received = 0, Lost = 2 (100% loss),

In this example, the message above is coming from the local stack, not a router.

(02 Feb '11, 13:51) Paul Stewart
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×74
×25

question asked: 02 Feb '11, 01:31

question was seen: 7,351 times

last updated: 02 Feb '11, 14:20

p​o​w​e​r​e​d by O​S​Q​A