5 Replies Latest reply: Aug 27, 2019 12:38 AM by Daniel Dib CCIE #37149 CCDE #20160011 RSS

    Packet fragmentation math

    Learner

      Hello all,

       

      I'm watching NetworkBruh explaining fragmentation. It all sounds good. But is his math correct?

       

      1.3.b IPv4 and IPv6 fragmentation - CCNP Route Exam 300-101 v2.0 - YouTube

       

       

      At 12:56, he has the incoming packet size at 2700 bytes and data length 2680 bytes.

      But at 17:30, the data length is changed to 2700 bytes. I don't know why he did that.

       

      Anyway, if the incoming packet size is 2700 bytes, minus the 20 byte header, the data length is 2680 bytes.

       

      The MTU is 1500. So the largest packet data length is 1480 bytes (1500 - 20) on the outgoing interface.

      This should be the data length of the first outgoing packet.

       

      Then we are left with 1200 bytes of data to be sent next (2680 bytes - 1480 bytes = 1200 bytes).

      The 2nd packet size would be data length of 1200 bytes + 20 bytes header = 1220 bytes, instead of his 1200 bytes.

       

      Who's correct?

       

      math before.jpg

       

      math.jpg

       

      -------------

       

      Then he did another fragmentation math with an incoming packet of 4600 bytes.

       

      I just don't think an incoming packet of 4600 bytes is not going to be broken down into 3 packets x 1500 bytes + 1 packet of 100 bytes on the outgoing.

       

      math 3.jpg

        • 1. Re: Packet fragmentation math
          Steven Davidson

          Looks like Network Bruh was a bit sloppy on his math.  An IP packet of size 4600 (20 header + 4580 payload) -> R1 -> 1500 MTU -> R2 would be 1500 (1480) +1500 (1480) +1500 (1480) +160 (140) = 1480+1480+1480+140 = 4580

          • 2. Re: Packet fragmentation math
            Daniel Dib CCIE #37149 CCDE #20160011

            What kind of packets are we discussing here? TCP for example is 20 bytes of header so the payload can't exceed 1460 bytes. If it's UDP we can fit more but UDP packets are generally not that big.

             

            This would be very easy to test in a lab. Just to confirm. Put two hosts connected to a router each and then generate a large packet and see what happens. What ICMP packets are generated? What does the headers look like?

            • 3. Re: Packet fragmentation math
              Learner

              Daniel Dib CCIE #37149 CCDE #20160011 wrote:

               

              What kind of packets are we discussing here? TCP for example is 20 bytes of header so the payload can't exceed 1460 bytes. If it's UDP we can fit more but UDP packets are generally not that big.

               

              This would be very easy to test in a lab. Just to confirm. Put two hosts connected to a router each and then generate a large packet and see what happens. What ICMP packets are generated? What does the headers look like?

               

              Just tried it out with ping. I have to say the math is a little weird.

               

              First I tried with data size 100 bytes.

               

              R1#ping 4.4.4.4 size ?

              <36-18024>  Datagram size


              R1#

              R1#ping 4.4.4.4 size 100 rep 1

              Type escape sequence to abort.

              Sending 1, 100-byte ICMP Echos to 4.4.4.4, timeout is 2 seconds:

              !

              Success rate is 100 percent (1/1), round-trip min/avg/max = 40/40/40 ms

              R1#

               

              According to Wireshark capture, this 100 bytes breaks down into

               

              72 ICMP datagram +

              8 bytes ICMP header +

              20 bytes IP header.

               

              icmp100.jpg

               

              --------------------------------

               

              Now I try with size 2000 bytes

               

              R1#

              R1#ping 4.4.4.4 size 2000 rep 1

              Type escape sequence to abort.

              Sending 1, 2000-byte ICMP Echos to 4.4.4.4, timeout is 2 seconds:

              !

              Success rate is 100 percent (1/1), round-trip min/avg/max = 48/48/48 ms

              R1#

               

              According to Wireshark, the packet is fragmented into two (is this called two fragments or two fragmented packets)?

               

              the first fragment is send as pure IP with datagram size of 1480 bytes. The second packet shows  ICMP datagram size of 1972 bytes.

               

              I tried to add everything up to come to 2000 bytes. The only logical numbers would be

               

              1480 bytes from first packet

              +

              520 bytes from second ICMP packet:

                   492 bytes of ICMP datagram +

                   8 bytes of ICMP header +

                   20 bytes of IP header

               

              If we add up 1480 bytes and 492 bytes from the above, we have 1972 bytes. This number is shown as ICMP data length on the second fragment.

               

              First fragment:

               

              icmp2000.jpg

               

              Second fragment:

               

              icmp2001.jpg

               

              --------------------

               

              Now I try size 4600 as Network Bro did on his video.

               

              R1#

              R1#ping 4.4.4.4 size 4600 rep 1

              Type escape sequence to abort.

              Sending 1, 4600-byte ICMP Echos to 4.4.4.4, timeout is 2 seconds:

              !

              Success rate is 100 percent (1/1), round-trip min/avg/max = 52/52/52 ms

              R1#

               

              4600 bytes =

               

              4440 bytes from first 3 fragments (1480 bytes x 3 fragments)

              +

              160 bytes from the last ICMP fragment:

                   132 bytes of ICMP datagram

                   8 bytes of ICMP header

                   20 bytes of IP header

               

              If we add 4440 bytes and 132 bytes from the above, we have 4572 bytes, which is shown as ICMP data length below.

               

              This is what Steven put down on his math too. I just didn't know how he got his numbers.

               

              icmp2002.jpg

              • 4. Re: Packet fragmentation math
                Learner

                Now we can verify size 2700 bytes as Network bro did his:

                 

                math.jpg

                 

                R1#

                R1#ping 4.4.4.4 size 2700 rep 1

                Type escape sequence to abort.

                Sending 1, 2700-byte ICMP Echos to 4.4.4.4, timeout is 2 seconds:

                !

                Success rate is 100 percent (1/1), round-trip min/avg/max = 48/48/48 ms

                R1#



                2700 bytes =


                1480 bytes from fragment 1

                +

                1220 from fragment 2

                     1192 bytes of ICMP datagram

                     8 bytes of ICMP header

                     20 bytes of IP header


                So his numbers are a little off.



                Fragment 1:


                icmp2700.jpg


                Fragment 2:

                icmp2701.jpg

                • 5. Re: Packet fragmentation math
                  Daniel Dib CCIE #37149 CCDE #20160011

                  Great work!

                   

                  I think the key here is that the initial fragment is filled to the max and doesn't include the ICMP header. When you say ping x.x.x.x with 2700 bytes, that means that 2700 bytes is the total size of the packet (ignore the Ethernet header). So 2700 - 20 bytes of IP and 8 bytes of ICMP means 2672 bytes in total.

                   

                  Your first packet had 1480 bytes payload. The second one had 1192 bytes payload. 1480 + 1192 = 2672. The final fragment will be the one that has the ICMP header and the other ones will just be IP packets. Does that make sense?