5 Replies Latest reply: Oct 10, 2011 11:49 AM by Elvin Arias RSS

    Check IP Datagram Fragmentation

    chrisjoms

      Hi guys, how to check IP Datagram Fragmentation on a router?

      is there a command to view the IP datagram and check whether it's fragmented or not?

       

      thanks in advance.

        • 1. Re: Check IP Datagram Fragmentation
          Efx

          You can use Wireshark or other packet sniffer.

           

          http://www.tech-faq.com/packet-fragmentation.html ( for more info about fragmentation)

          • 2. Re: Check IP Datagram Fragmentation
            Elvin Arias

            You can use the "debug ip packet detail" command to see if fragmentation is comming into place.

             

            You can use this command attached to an ACL to see specifics of about a source/destination IP address/source/destination ports, etc!

             

            Here is an example of the "debug ip packet detail" output:

            R1 => 10.12.12.1 ---- R2 => 10.12.12.2

             

            R1#debug ip packet detail

            IP packet debugging is on (detailed)

             

            Now, let's ping the remote destination with a normal MTU of 1500.

             

            R1#ping 10.12.12.2 size 1500 repeat 1

             

            Type escape sequence to abort.

            Sending 1, 1500-byte ICMP Echos to 10.12.12.2, timeout is 2 seconds:

            !

            Success rate is 100 percent (1/1), round-trip min/avg/max = 236/236/236 ms

            R1#

            *Mar  1 00:07:18.843: IP: tableid=0, s=10.12.12.1 (local), d=10.12.12.2 (FastEthernet0/0), routed via FIB

            *Mar  1 00:07:18.843: IP: s=10.12.12.1 (local), d=10.12.12.2 (FastEthernet0/0), len 1500, sending

             

            There is not fragmentation in this output, but let see another example where there is fragmentation:

             

            R1#ping 10.12.12.2 size 1700 repeat 1

             

            Type escape sequence to abort.

            Sending 1, 1700-byte ICMP Echos to 10.12.12.2, timeout is 2 seconds:

            !

            Success rate is 100 percent (1/1), round-trip min/avg/max = 228/228/228 ms

            R1#

            *Mar  1 00:09:25.351: IP: tableid=0, s=10.12.12.1 (local), d=10.12.12.2 (FastEthernet0/0), routed via FIB

            *Mar  1 00:09:25.351: IP: s=10.12.12.1 (local), d=10.12.12.2 (FastEthernet0/0), len 1700, sending

            *Mar  1 00:09:25.355:     ICMP type=8, code=0

            *Mar  1 00:09:25.355: IP: s=10.12.12.1 (local), d=10.12.12.2 (FastEthernet0/0), len 1500, sending fragment

            *Mar  1 00:09:25.355:     IP Fragment, Ident = 20, fragment offset = 0

            *Mar  1 00:09:25.355:     ICMP type=8, code=0

            *Mar  1 00:09:25.359: IP: s=10.12.12.1 (local), d=10.12.12.2 (FastEthernet0/0), len 220, sending last fragment

            *Mar  1 00:09:25.359:     IP Fragment, Ident = 20, fragment offset = 1480

            *Mar  1 00:09:25.567: IP: tableid=0, s=10.12.12.2 (FastEthernet0/0), d=10.12.12.1 (FastEthernet0/0), routed via RIB

            *Mar  1 00:09:25.571: IP: s=10.12.12.2 (FastEthernet0/0), d=10.12.12.1 (FastEthernet0/0), len 1500, rcvd 3

            *Mar  1 00:09:25.571:     IP Fragment, Ident = 20, fragment offset = 0

            *Mar  1 00:09:25.571:     ICMP type=0, code=0

            *Mar  1 00:09:25.575: IP: recv fragment from 10.12.12.2 offset 0 bytes

            *Mar  1 00:09:25.575: IP: tableid=0, s=10.12.12.2 (FastEthernet0/0), d=10.12.12.1 (FastEthernet0/0), routed via RIB

            *Mar  1 00:09:25.575: IP: s=10.12.12.2 (FastEthernet0/0), d=10.12.12.1 (FastEthernet0/0), len 220, rcvd 3

            *Mar  1 00:09:25.579:     IP Fragment, Ident = 20, fragment offset = 1480

            *Mar  1 00:09:25.579: IP: recv fragment from 10.12.12.2 offset 1480 bytes

             

            There is fragmentation in this output

             

            Elvin

             

            Message was edited by: Elvin Arias

            • 3. Re: Check IP Datagram Fragmentation
              chrisjoms

              Thank you guys

              • 4. Re: Check IP Datagram Fragmentation
                Vijay Swaminathan

                Hi Elvin,

                 

                just curious.. I see that fragmentation works here but trying to understand what is happening inside..

                 

                so the 1700 Bytes of data is splitted into two.

                 

                1. 1480 Bytes + TCP header 20 Bytes which result to 1500..

                2. Remaining 220 Bytes of data is sent as it is .

                Mar  1 00:09:25.575: IP: s=10.12.12.2 (FastEthernet0/0), d=10.12.12.1 (FastEthernet0/0), len 220, rcvd 3

                 

                why is the TCP header not added here?? or am I missing something basic here?

                 

                Also, can we define the fragment size (1500 in this case) in the CLI .. for example, I want to fragment packets at every 1000 Bytes of data.. is that possible? (possibly defining MTU would work??)

                • 5. Re: Check IP Datagram Fragmentation
                  Elvin Arias

                  Hi,

                   

                  Yes, you could define a MTU in a specific interface with the "ip mtu" interface level command. But remember that if the MTU i a "Jumbo frame" (normally a frame bigger 1500 bytes), this could cause overhead in the process of frames in your equipment, so this is not recommended in production enviroments.

                   

                  Remember that the IP header is basically scrambled into pieces and there is only one portion of the entire packet that has the actual IP header inside, so for this reason when the router (in this case) receives the fragmented IP packet saves the fragments into a buffer until the last segment of the packet is received. This is done by TCP to reassemble the entire packet.

                   

                  You could read more information about the operations of TCP in its RFC http://www.faqs.org/rfcs/rfc793.html

                   

                  Here is more information about this operation http://www.erg.abdn.ac.uk/~gorry/eg3567/inet-pages/ip-fragmentatiion.html

                   

                  Elvin

                   

                  Message was edited by: Elvin Arias