Skip navigation
Cisco Learning Home > Certifications > Routing & Switching (CCNA) > Discussions

_Communities

This Question is Answered 1 Helpful Answer available (2 pts)
3568 Views 5 Replies Latest reply: Oct 10, 2011 11:49 AM by Elvin Arias RSS

Currently Being Moderated

Check IP Datagram Fragmentation

Oct 3, 2011 10:35 PM

chrisjoms 378 posts since
Jul 22, 2010

Hi guys, how to check IP Datagram Fragmentation on a router?

is there a command to view the IP datagram and check whether it's fragmented or not?

 

thanks in advance.

  • Efx 628 posts since
    Jun 26, 2010
    Currently Being Moderated
    1. Oct 4, 2011 7:29 AM (in response to chrisjoms)
    Re: Check IP Datagram Fragmentation

    You can use Wireshark or other packet sniffer.

     

    http://www.tech-faq.com/packet-fragmentation.html ( for more info about fragmentation)

  • Elvin Arias 1,828 posts since
    Mar 12, 2010
    Currently Being Moderated
    2. Oct 4, 2011 7:53 AM (in response to chrisjoms)
    Re: Check IP Datagram Fragmentation

    You can use the "debug ip packet detail" command to see if fragmentation is comming into place.

     

    You can use this command attached to an ACL to see specifics of about a source/destination IP address/source/destination ports, etc!

     

    Here is an example of the "debug ip packet detail" output:

    R1 => 10.12.12.1 ---- R2 => 10.12.12.2

     

    R1#debug ip packet detail

    IP packet debugging is on (detailed)

     

    Now, let's ping the remote destination with a normal MTU of 1500.

     

    R1#ping 10.12.12.2 size 1500 repeat 1

     

    Type escape sequence to abort.

    Sending 1, 1500-byte ICMP Echos to 10.12.12.2, timeout is 2 seconds:

    !

    Success rate is 100 percent (1/1), round-trip min/avg/max = 236/236/236 ms

    R1#

    *Mar  1 00:07:18.843: IP: tableid=0, s=10.12.12.1 (local), d=10.12.12.2 (FastEthernet0/0), routed via FIB

    *Mar  1 00:07:18.843: IP: s=10.12.12.1 (local), d=10.12.12.2 (FastEthernet0/0), len 1500, sending

     

    There is not fragmentation in this output, but let see another example where there is fragmentation:

     

    R1#ping 10.12.12.2 size 1700 repeat 1

     

    Type escape sequence to abort.

    Sending 1, 1700-byte ICMP Echos to 10.12.12.2, timeout is 2 seconds:

    !

    Success rate is 100 percent (1/1), round-trip min/avg/max = 228/228/228 ms

    R1#

    *Mar  1 00:09:25.351: IP: tableid=0, s=10.12.12.1 (local), d=10.12.12.2 (FastEthernet0/0), routed via FIB

    *Mar  1 00:09:25.351: IP: s=10.12.12.1 (local), d=10.12.12.2 (FastEthernet0/0), len 1700, sending

    *Mar  1 00:09:25.355:     ICMP type=8, code=0

    *Mar  1 00:09:25.355: IP: s=10.12.12.1 (local), d=10.12.12.2 (FastEthernet0/0), len 1500, sending fragment

    *Mar  1 00:09:25.355:     IP Fragment, Ident = 20, fragment offset = 0

    *Mar  1 00:09:25.355:     ICMP type=8, code=0

    *Mar  1 00:09:25.359: IP: s=10.12.12.1 (local), d=10.12.12.2 (FastEthernet0/0), len 220, sending last fragment

    *Mar  1 00:09:25.359:     IP Fragment, Ident = 20, fragment offset = 1480

    *Mar  1 00:09:25.567: IP: tableid=0, s=10.12.12.2 (FastEthernet0/0), d=10.12.12.1 (FastEthernet0/0), routed via RIB

    *Mar  1 00:09:25.571: IP: s=10.12.12.2 (FastEthernet0/0), d=10.12.12.1 (FastEthernet0/0), len 1500, rcvd 3

    *Mar  1 00:09:25.571:     IP Fragment, Ident = 20, fragment offset = 0

    *Mar  1 00:09:25.571:     ICMP type=0, code=0

    *Mar  1 00:09:25.575: IP: recv fragment from 10.12.12.2 offset 0 bytes

    *Mar  1 00:09:25.575: IP: tableid=0, s=10.12.12.2 (FastEthernet0/0), d=10.12.12.1 (FastEthernet0/0), routed via RIB

    *Mar  1 00:09:25.575: IP: s=10.12.12.2 (FastEthernet0/0), d=10.12.12.1 (FastEthernet0/0), len 220, rcvd 3

    *Mar  1 00:09:25.579:     IP Fragment, Ident = 20, fragment offset = 1480

    *Mar  1 00:09:25.579: IP: recv fragment from 10.12.12.2 offset 1480 bytes

     

    There is fragmentation in this output

     

    Elvin

     

    Message was edited by: Elvin Arias

  • Vijay Swaminathan 491 posts since
    Aug 29, 2008
    Currently Being Moderated
    4. Oct 10, 2011 4:11 AM (in response to Elvin Arias)
    Re: Check IP Datagram Fragmentation

    Hi Elvin,

     

    just curious.. I see that fragmentation works here but trying to understand what is happening inside..

     

    so the 1700 Bytes of data is splitted into two.

     

    1. 1480 Bytes + TCP header 20 Bytes which result to 1500..

    2. Remaining 220 Bytes of data is sent as it is .

    Mar  1 00:09:25.575: IP: s=10.12.12.2 (FastEthernet0/0), d=10.12.12.1 (FastEthernet0/0), len 220, rcvd 3

     

    why is the TCP header not added here?? or am I missing something basic here?

     

    Also, can we define the fragment size (1500 in this case) in the CLI .. for example, I want to fragment packets at every 1000 Bytes of data.. is that possible? (possibly defining MTU would work??)

  • Elvin Arias 1,828 posts since
    Mar 12, 2010
    Currently Being Moderated
    5. Oct 10, 2011 11:49 AM (in response to Vijay Swaminathan)
    Re: Check IP Datagram Fragmentation

    Hi,

     

    Yes, you could define a MTU in a specific interface with the "ip mtu" interface level command. But remember that if the MTU i a "Jumbo frame" (normally a frame bigger 1500 bytes), this could cause overhead in the process of frames in your equipment, so this is not recommended in production enviroments.

     

    Remember that the IP header is basically scrambled into pieces and there is only one portion of the entire packet that has the actual IP header inside, so for this reason when the router (in this case) receives the fragmented IP packet saves the fragments into a buffer until the last segment of the packet is received. This is done by TCP to reassemble the entire packet.

     

    You could read more information about the operations of TCP in its RFC http://www.faqs.org/rfcs/rfc793.html

     

    Here is more information about this operation http://www.erg.abdn.ac.uk/~gorry/eg3567/inet-pages/ip-fragmentatiion.html

     

    Elvin

     

    Message was edited by: Elvin Arias

Actions

More Like This

  • Retrieving data ...

Bookmarked By (0)