If you can't see the full image, open the image URL in new window.
On Windows 7, ping www.ea.com -l 32000
Why I am not seeing the fragmentation in Wireshark? I set payload to 32000 bytes but Wireshark is only seeing 1472 bytes (1500 bytes IP MTU- 20 bytes IP header - 8 bytes ICMP ECHO header). So where are the rest 30528 bytes?
I am pretty sure those fragments are actually sent because I still get fragment reassembly time exceeded minutes after the ping.
I unchecked IP Reassembly but it made no difference.
asked 23 Jun '13, 18:56
Your display filter of "
Right-click on an ICMP packet of interest and select,
"I unchecked IP Reassembly but it made no difference."
Actually, it did/does make a difference. If you have IP reassembly turned off, the first packet will carry the ICMP header and be shown as ICMP, whereas if you have IP reassembly turned on, the last packet will be indicated as the entire reassembled ICMP packet.
answered 23 Jun '13, 19:11