Revision history [back]

Hi,

You're missing 2 things:

1. Second fragment doesn't have ICMP header, only IP header. It uses IP ID field to correlate with the first fragment.
2. Probably your NIC is responsible for adding the padding to 60 Bytes + FCS of 4 Bytes. You're capturing before both of these are added.

Hi,

You're missing 2 things:

1. Second fragment doesn't have ICMP header, only IP header. It uses IP ID ID field, and Fragment offset field to correlate with the first fragment.
2. Probably your NIC is responsible for adding the padding to 60 Bytes + FCS of 4 Bytes. You're capturing before both of these are added. added.

Hi,

You're missing 2 things:

1. Second fragment doesn't have ICMP header, only IP header. It uses IP ID field, and Fragment offset field to correlate with the first fragment.
2. Probably your NIC is responsible for adding the padding to 60 Bytes + FCS of 4 Bytes. You're capturing before both of these are added.added. In the received ICMP Echo Reply you see 60-Bytes second fragment as it should be (FCS is not seen usually).

Hi,

You're missing 2 things:

1. Second fragment doesn't have its own ICMP header, only IP header. It uses IP ID field, and Fragment offset field to correlate with the first fragment.
2. Probably your NIC is responsible for adding the padding to 60 Bytes + FCS of 4 Bytes. You're capturing before both of these are added. In the received ICMP Echo Reply you see 60-Bytes second fragment as it should be (FCS is not seen usually).