Fragmentation
I have access to RouterA which is a Cisco device. Int gig 0/0/1 uplinks to RouterB which I don’t have access to. I’m pulling a pcap from RouterA on gig 0/0/1 and I’m seeing a lot of fragmentation. This is actually expected. Not ideal but expected.
The source address on the fragments is RouterB. It’s a GRE tunnel and that’s the tunnel interface, next hop is my RouterA. My ip mtu is 1424. I see an IP packet that’s 1424, source is RouterB’s address and a fragment that’s 768, with the internal IP (no second IPHeader or GRE header) I know jumbo frames is enabled on RouterB. Given the setup this is working as designed.
I’m trying to determine which device is doing the fragmentation.
Based on this info can I state unequivocally that RouterB is fragmenting?
Or is RouterB handing me a jumbo frame of nearly 2200 bytes and RouterA is actually fragmenting?
Look at the source IP address of the fragmented packet.
Derp! Just wanted to be sure it was as I was seeing it. Gracias.