I'm trying to understand IP fragmentation for a network test and the way Wireshark displays the fragmented packets is not making much sense to me.
Here are my assumptions:
- Ethernet Type II Frame : 1514 bytes (Wireshark does not show the last 4 bytes of CRC) = 14 Bytes Header + 1500 Bytes Max Payload
- IP Packet: 20 Bytes Header + 1480 Bytes Max Payload
- ICMP Packet: 8 Bytes Header + 1472 Bytes Max Payload
TOPOLOGY:
HOST (10.0.0.101)------------------ SWITCH (10.0.0.100)
CASE 1:
Host pings Switch: ping 10.0.0.100 -l 1472
On Wireshark, I see no fragmentation as expected.
CASE 2:
Host pings Switch: ping 10.0.0.100 -l 1473
On Wireshard, I see 2 packets:
One of IPv4 Protocol Type of 1514 Byte Size Length + One of ICMP Protocol Type of 35 Byte Size Length, fragmentation is expected since Payload of 1473 is one (1) Byte larger than ICMP Max Payload size. So I'd expect, the second packet being of a size of: 14 (Eth Type II Header) + 20 (IP Header) + 8 (ICMP Header) + 1 (Byte left from Payload) = 43 Bytes
Also, shouldn't a Eth Frame have a Min size of 64 Bytes?
What am I missing?
Thanks in advance
