I'm using Wireshark to learn about my network and better understand MTU and packet sizes, and I'm looking for some clarity on this example. Here I ran ping 192.168.10.53 -s 9000 -M do from a CentOS machine and I am capturing on the receiving machine which is Windows. So I expect the ICMP packet should contain 9000 bytes of data plus 8 byte header.
Wireshark shows the frame is 9042 bytes on wire (14 Ethernet header + 20 IPv4 header + 9008 ICMP)
The ICMP packet shows 8992 bytes of data plus 8 byte header.
What happened to the extra 8 bytes of data?
