This is our old Q&A Site. Please post any new questions and answers at

When i request 12000 bytes(ping size) then i see that fragmentation happens

so after fragmentation result shows (1480*8) + 168 bytes = 12000

so last frame size should be 168(data)+20(IP)+8(ICMP)+14(frame header) = 210 Bytes

but as i saw frame length is showing 202 Bytes.. why ICMP packet are not added only for fragmented packet.

for normal 32 bytes ICMP condition it works fine..

Jasper could you please help me on that

This question is marked "community wiki".

asked 14 Mar '15, 22:24

Lvi's gravatar image

accept rate: 0%

converted to question 15 Mar '15, 03:32

grahamb's gravatar image

grahamb ♦

Keep in mind that when IP fragments a large ICMP packet (or any packet, actually) only the first will have the ICMP (or other layer 4) header. All others will just have the remaining payload fragments right after the IPv4 header. Check your 9 packets - the first has Ethernet/IP/ICMP/payload, all other 8 packets will only have Ethernet/IP/payload.

So the 8 byte you're missing is the ICMP header. Also, the first packet only has 1472 bytes ping payload, because of the header (so 1480 is the ICMP header plus payload).

permanent link

answered 15 Mar '15, 08:32

Jasper's gravatar image

Jasper ♦♦
accept rate: 18%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 14 Mar '15, 22:24

question was seen: 2,541 times

last updated: 15 Mar '15, 08:32

p​o​w​e​r​e​d by O​S​Q​A