This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Fragmentation at source why?

0

In my scenario it’s a flat network where couple of host is connected to a switch belonging to same VLAN. The MTU of the link is 1500 and also the Solaris Linux v6 hosts are also configured with this setting. But in fact in traces I could see that they send fragmented IP packets to hosts in the same LAN.

From my understanding the upper layer protocols like TCP or UDP send data to IP layer which then creates an IP packet which matches the size of the outgoing link. But in capture I can see that the IP layer instead of building packets which matches the MTU, it fragments. What could be the reason for this?

Is there any implementation in which the upper layer tells IP to always fragment :(?

asked 24 Jan '17, 13:35

soochi's gravatar image

soochi
57349
accept rate: 0%

There might be some reasons. Can you share us a trace?

(24 Jan '17, 13:41) Christian_R

for example if i ping a host with packet size exceeding the MTU, ip will fragment it (unless DF set). But how/why does the upper layer protocol influence this?

(24 Jan '17, 13:54) soochi

One Answer:

0

Fragmentation occurs when the size of the packet exceeds the MTU. If the upper layer protocol, UDP for example, hands IP a datagram that, combined with the IP header, would result in an IP packet larger than the interface MTU, the packet will be fragmented by the IP layer. How much data is being handed to IP from the upper layers? A capture file might be more helpful to understand what's going on. You can post it to cloudshark or some other place and provide the link in your edited question.

Also, what platform are you running on and is PMTUD enabled or not? On some platforms, "When PMTU discovery is disabled, a MTU of 576 bytes is used for all non-local destination IP addresses."

answered 24 Jan '17, 13:44

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

edited 24 Jan '17, 13:52

what i basically wanto to know is if ...

when the upper layer protocol handles a junk of data to IP, which then packetises it as per the link level MTU

or...

if the given junk of data is put into one packet and then fragmented as per the link MTU

(24 Jan '17, 14:00) soochi
1

When IP receives an upper-layer UDP datagram or TCP segment, if the size of that data exceeds the MTU, then IP will fragment it as needed so that no fragment exceeds the MTU size.

Perhaps a review of RFC791 would also help?

(24 Jan '17, 14:06) cmaynard ♦♦