IP Fragmentation – Calculating Total Length and Payload of IP Datagram

You have them all correct.

5th fragment: remember that the routers can change their settings at any time, and the fragmentation limit can change from one packet to the next. When you fragment already fragmented packets, you normally see something like this:

• original sends (say) 4001 byte packet
• through something which fragments it into three: 2000, 2000, 1.
• through something which fragments it into 5: 1600, 400, 1600, 400, 1.

This big-small-big-small is characteristic of fragmented fragments. Normally reassembly is only done at the final host, or a host doing security or NAT. (Note that the fragements can overwrite other fragments, which has had some security implications. I believe most current IP stacks will discard such funny-fragment packets.)

The IP layer discards the bad packet, perhaps sending ICMP problem report. It never gets to the UDP-handling layer.

I do recommend reading RFC 791 on fragmentation and reassembly. https://www.rfc-editor.org/rfc/rfc791

PS. Your example table has some assumptions: 20-byte headers, and that all these packets had the same destination address.

The TTL of a packet is decremented as the packet is processed by the IP process upon reception in the router. The packet gets fragmented, if necessary to traverse the exit network (assuming the packet is not marked DF), by the IP process at the exit interface of the router. The TTL of the resulting packet fragments will be the same as if the packet were not fragmented.

RFC 791, Internet Protocol has a full description of fragmentation, and it explains that the header fields are copied from the original packet to the packet fragments:

To fragment a long internet datagram, an internet protocol module (for example, in a gateway), creates two new internet datagrams and copies the contents of the internet header fields from the long datagram into both new internet headers. The data of the long datagram is divided into two portions on a 8 octet (64 bit) boundary (the second portion might not be an integral multiple of 8 octets, but the first must be). Call the number of 8 octet blocks in the first portion NFB (for Number of Fragment Blocks). The first portion of the data is placed in the first new internet datagram, and the total length field is set to the length of the first datagram. The more-fragments flag is set to one. The second portion of the data is placed in the second new internet datagram, and the total length field is set to the length of the second datagram. The more-fragments flag carries the same value as the long datagram. The fragment offset field of the second new internet datagram is set to the value of that field in the long datagram plus NFB.

This procedure can be generalized for an n-way split, rather than the two-way split described.