Fragmentation and packet size,using tcpdump

fragmentationicmpnetworkingpingtcpdump

i am trying to understand concept of fragmentation:

i have two virtual machines with public ip connected to a switch.

tracepath shows packet not going through gateway

from vm1:
Trying to send icmp with 65507 bytes to vm2.

ping -M want -s 65507 vm2 

but in tcpdump output on vm2: its showing

tcpdump -evvv icmp

12:48:44.635551 42:43:30:b4:89:0c (oui Unknown) > b6:7a:6b:7d:54:32 (oui Unknown), ethertype IPv4 (0x0800), length 1514: (tos 0x0, ttl 64, id 10843, offset 1480, flags [+], proto ICMP (1), length 1500)
VM1 > VM2: icmp
12:48:44.635568 42:43:30:b4:89:0c (oui Unknown) > b6:7a:6b:7d:54:32 (oui Unknown), ethertype IPv4 (0x0800), length 1514: (tos 0x0, ttl 64, id 10843, offset 2960, flags [+], proto ICMP (1), length 1500)
VM1 > Vm2: icmp
12:48:44.635572 42:43:30:b4:89:0c (oui Unknown) > b6:7a:6b:7d:54:32 (oui Unknown), ethertype IPv4 (0x0800), length 1514: (tos 0x0, ttl 64, id 10843, offset 4440, flags [+], proto ICMP (1), length 1500)
VM1>VM2 icmp
12:48:44.635575 42:43:30:b4:89:0c (oui Unknown) > b6:7a:6b:7d:54:32 (oui Unknown), ethertype IPv4 (0x0800), length 1514: (tos 0x0, ttl 64, id 10843, offset 5920, flags [+], proto ICMP (1), length 1500)
VM1>VM2: icmp
12:48:44.635578 42:43:30:b4:89:0c (oui Unknown) > b6:7a:6b:7d:54:32 (oui Unknown), ethertype IPv4 (0x0800), length 1514: (tos 0x0, ttl 64, id 10843, offset 7400, flags [+], proto ICMP (1), length 1500)
**Vm1 > VM2**: icmp
12:48:44.635581 42:43:30:b4:89:0c (oui Unknown) > b6:7a:6b:7d:54:32 (oui Unknown), ethertype IPv4 (0x0800), length 1514: (tos 0x0, ttl 64, id 10843, offset 8880, flags [+], proto ICMP (1), length 1500)

This is repeated 31 times until is received fully. full paste: http://pastebin.com/cnQhn8dK

So why it looks like total data received is 1500*31=46500 bytes and what happened to 65507-46500=19007 bytes.

Can some one please clarify this.

Best Answer

Yes, using tcpdump with -s option, the result is now right. As your result, we count 45 packet. 44 packets with 1500 bytes, 1 packet 415 bytes.

44*1500 + 415 = 66415

66415 - 65507 = 908

908 / 45 = 20 plus 8

You can see, each packet add 20 byte for ip header + 8 byte icmp header for the first packet.

Related Topic