Practical Packet Analysis

Fragmented Packets

ipfragments.pcap

Internet Protocol is used for the bulk of data transfer across a network, but we often overlook the fact that only so much data can fit on the wire at a time. In order to address these lower layer limitations, IP features a technology called fragmentation. IP fragmentation allows the protocol to break large amounts of data into chunks that can be sent across the wire and reassembled on the receiving system.

In this section, we'll look at a stream of data that has been fragmented by IP.

The trace file ipfragments.pcap consists of 24 packets that show a ping request and response. From our previous experience, we know that a typical ICMP ping-and-response sequence only takes eight packets. Then why do we have so many ...