Just recently I came to know that the payload of Ethernet is max 1500 bytes (mtu).
The first thing that came to my mind was that we can ping with much more size than that. So I thought maybe the ping packet is being fragemented in someway. So I checked on wireshark and I saw that it's only one packet, even when I ping with size of 10,000 bytes.
What is the explanation behind this?
Update:
Even if Jumbo Ethernet frames are used, which supports till 9000 bytes, I can still ping with like 17,000 bytes which is still larger than 9000.
Best Answer
Based on @ColtonCat comment
The answer is simply because IP fragmentation takes place.
Example: ping with size 2000 bytes and the mtu is max 1518, you can see in wireshark that both ping request and reply are each fragemnted into 1518 and 566 bytes packets.
Calulation is as follows: 18 bytes for Ethernet header (src mac 6, dst mac 6 , type 2, FCS 4), 20 bytes for IP header, 8 bytes for ICMP >> 46. The mtu is 1518, so that leaves 1472 bytes of data (1518 - 46).
The same calulations is done for the second fragmented packet.
Note: Wireshark doesn't show the FCS bytes. So you just need to substract 4. Also, all of this may take place for IPv4, as in IPv6 no fragemenation is allowed.