First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

13 bit fragmentation offset for last fragment

Wireshark Version used : 3.2.1 (v3.2.1-0-gbf38a67724d0)

I am capturing on wireshark on the link R1 to R2 to verify ip fragmenation . Please obsere the last Fragment 13 bit Offset value

ping 192.168.30.3 size 10000

My question is at before 7nth fragment . Attached wireshark capture .

Data size : 10000 - 20 = 9980
Number of Fragments : 9980/1480 = 6.7 = 7 fragments

1st Fragment :
Offset = 0 , M = 1 , Total Length = 1500 (i.e 1480 + 20 bytes)
Total Data sent = 1480

2nd Fragment :
Offset = 1480, M = 1 , Total Length = 1500 (i.e 1480 + 20 bytes)
Total Data sent = 2960

3rd Fragment :
Offset = 2960, M = 1 , Total Length = 1500 (i.e 1480 + 20 bytes)
Total Data sent = 4440

4rth Fragment :
Offset = 4440 , M = 1 , Total Length = 1500 (i.e 1480 + 20 bytes)
Total Data sent = 5920

5th Fragment :
Offset = 5920 , M = 1 , Total Length = 1500 (i.e 1480 + 20 bytes)
Total Data sent = 7400

6th Fragment :
Offset = 7400 , M = 1 , Total Length = 1500 (i.e 1480 + 20 bytes)
Total Data sent = 8880

7th Fragment :
Offset = 8500 , M = 0 , Total Length = 1120 (i.e 1100 + 20 bytes)
Total Data sent = 9980

Above is calculated logically . Now we will check the wireshark capture , go to ip header --> flags select this and observe the value this is on hex shown as 04 56 which is 1110 , but its shown as 688 .

Attached captured and few screenshots :

https://drive.google.com/drive/folder...

Regards, Sameer.

sameerece's avatar
1
sameerece
asked 2020-01-30 15:44:38 +0000, updated 2020-02-01 11:48:44 +0000
edit flag offensive 0 remove flag close merge delete

Comments

Can you put the capture on a public file sharing site (Dropbox, Google Drive, Onedrive, ...) and post a link to it here.

Chuckc's avatar Chuckc (2020-01-30 15:54:16 +0000) edit
add a comment see more comments

1 Answer

0

This is a known bug that has already been reported and fixed, and which will be available in the next Wireshark stable releases, currently scheduled for February 26, 2020. Refer to the Roadmap wiki page for the planned release schedule.

If you don't want to wait until the next release, you may be able to download a recent automated build from https://www.wireshark.org/download/au..., assuming there's one available for your particular platform/OS.

See Bug 16344 for more details about the bug regarding the IPv4 fragment offset as well as the fix for it.

cmaynard's avatar
11.1k
cmaynard
answered 2020-01-30 16:52:44 +0000
edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer