13 bit fragmentation offset for last fragment
Wireshark Version used : 3.2.1 (v3.2.1-0-gbf38a67724d0)
I am capturing on wireshark on the link R1 to R2 to verify ip fragmenation . Please obsere the last Fragment 13 bit Offset value
ping 192.168.30.3 size 10000
My question is at before 7nth fragment . Attached wireshark capture .
Data size : 10000 - 20 = 9980
Number of Fragments : 9980/1480 = 6.7 = 7 fragments
1st Fragment :
Offset = 0 , M = 1 , Total Length = 1500 (i.e 1480 + 20 bytes)
Total Data sent = 1480
2nd Fragment :
Offset = 1480, M = 1 , Total Length = 1500 (i.e 1480 + 20 bytes)
Total Data sent = 2960
3rd Fragment :
Offset = 2960, M = 1 , Total Length = 1500 (i.e 1480 + 20 bytes)
Total Data sent = 4440
4rth Fragment :
Offset = 4440 , M = 1 , Total Length = 1500 (i.e 1480 + 20 bytes)
Total Data sent = 5920
5th Fragment :
Offset = 5920 , M = 1 , Total Length = 1500 (i.e 1480 + 20 bytes)
Total Data sent = 7400
6th Fragment :
Offset = 7400 , M = 1 , Total Length = 1500 (i.e 1480 + 20 bytes)
Total Data sent = 8880
7th Fragment :
Offset = 8500 , M = 0 , Total Length = 1120 (i.e 1100 + 20 bytes)
Total Data sent = 9980
Above is calculated logically . Now we will check the wireshark capture , go to ip header --> flags select this and observe the value this is on hex shown as 04 56 which is 1110 , but its shown as 688 .
Attached captured and few screenshots :
https://drive.google.com/drive/folder...
Regards, Sameer.
Can you put the capture on a public file sharing site (Dropbox, Google Drive, Onedrive, ...) and post a link to it here.