Ask Your Question
0

13 bit fragmentation offset for last fragment

asked 2020-01-30 15:44:38 +0000

sameerece gravatar image

updated 2020-02-01 11:48:44 +0000

Wireshark Version used : 3.2.1 (v3.2.1-0-gbf38a67724d0)

I am capturing on wireshark on the link R1 to R2 to verify ip fragmenation . Please obsere the last Fragment 13 bit Offset value

ping 192.168.30.3 size 10000

My question is at before 7nth fragment . Attached wireshark capture .

Data size : 10000 - 20 = 9980
Number of Fragments : 9980/1480 = 6.7 = 7 fragments

1st Fragment :
Offset = 0 , M = 1 , Total Length = 1500 (i.e 1480 + 20 bytes)
Total Data sent = 1480

2nd Fragment :
Offset = 1480, M = 1 , Total Length = 1500 (i.e 1480 + 20 bytes)
Total Data sent = 2960

3rd Fragment :
Offset = 2960, M = 1 , Total Length = 1500 (i.e 1480 + 20 bytes)
Total Data sent = 4440

4rth Fragment :
Offset = 4440 , M = 1 , Total Length = 1500 (i.e 1480 + 20 bytes)
Total Data sent = 5920

5th Fragment :
Offset = 5920 , M = 1 , Total Length = 1500 (i.e 1480 + 20 bytes)
Total Data sent = 7400

6th Fragment :
Offset = 7400 , M = 1 , Total Length = 1500 (i.e 1480 + 20 bytes)
Total Data sent = 8880

7th Fragment :
Offset = 8500 , M = 0 , Total Length = 1120 (i.e 1100 + 20 bytes)
Total Data sent = 9980

Above is calculated logically . Now we will check the wireshark capture , go to ip header --> flags select this and observe the value this is on hex shown as 04 56 which is 1110 , but its shown as 688 .

Attached captured and few screenshots :

https://drive.google.com/drive/folder...

Regards, Sameer.

edit retag flag offensive close merge delete

Comments

Can you put the capture on a public file sharing site (Dropbox, Google Drive, Onedrive, ...) and post a link to it here.

Chuckc gravatar imageChuckc ( 2020-01-30 15:54:16 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2020-01-30 16:52:44 +0000

cmaynard gravatar image

This is a known bug that has already been reported and fixed, and which will be available in the next Wireshark stable releases, currently scheduled for February 26, 2020. Refer to the Roadmap wiki page for the planned release schedule.

If you don't want to wait until the next release, you may be able to download a recent automated build from https://www.wireshark.org/download/au..., assuming there's one available for your particular platform/OS.

See Bug 16344 for more details about the bug regarding the IPv4 fragment offset as well as the fix for it.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2020-01-30 15:44:38 +0000

Seen: 787 times

Last updated: Feb 01 '20