This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

If you can't see the full image, open the image URL in new window.

On Windows 7, ping www.ea.com -l 32000

Why I am not seeing the fragmentation in Wireshark? I set payload to 32000 bytes but Wireshark is only seeing 1472 bytes (1500 bytes IP MTU- 20 bytes IP header - 8 bytes ICMP ECHO header). So where are the rest 30528 bytes?

I am pretty sure those fragments are actually sent because I still get fragment reassembly time exceeded minutes after the ping.

I unchecked IP Reassembly but it made no difference.

alt text

alt text

asked 23 Jun '13, 18:56

realdreams's gravatar image

realdreams
1111
accept rate: 0%


Your display filter of "icmp" is what is causing you grief. The IP fragments don't match that filter (except for the 1st one in the case when you have IP reassembly disabled or the last one in the case when you have IP reassembly enabled), so they aren't shown. If you want to see all the fragments, you could try the following (which should work fairly well in most cases, unless there also happens to be other traffic besides your ICMP packets of interest included in that IP conversation filter, in which case you will have to filter that out with additional filters):

Right-click on an ICMP packet of interest and select, "Conversation Filter -> IP"

"I unchecked IP Reassembly but it made no difference."

Actually, it did/does make a difference. If you have IP reassembly turned off, the first packet will carry the ICMP header and be shown as ICMP, whereas if you have IP reassembly turned on, the last packet will be indicated as the entire reassembled ICMP packet.

permanent link

answered 23 Jun '13, 19:11

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×74
×30

question asked: 23 Jun '13, 18:56

question was seen: 14,397 times

last updated: 23 Jun '13, 19:11

p​o​w​e​r​e​d by O​S​Q​A