1.1.d IPv4 and IPv6 fragmentation, plus wireshark

1.3.c [i] Using Wireshark trace analyzer

with the df-bit set, sending packets at a higher mtu will be dropped by the receiver…

(using extended ping commands, without walking through the prompts)

R2#ping 172.16.1.1 df-bit

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
Packet sent with the DF bit set
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 20/37/64 ms

of course the packets get through…

R2#ping 172.16.1.1 size 1501 df-bit

Type escape sequence to abort.
Sending 5, 1501-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
Packet sent with the DF bit set
…..
Success rate is 0 percent (0/5)

that ping failed because the df-bit was set, negating fragmentation of the out of mtu packet

if we don’t set the df-bit and ship packets at a higher mtu:

R2#ping 172.16.1.1 siz 1600

Type escape sequence to abort.
Sending 5, 1600-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 40/55/92 ms

we have success but we automatically set the mf-bit, as below

mfcap

a note about display filters… look closely at the filter… it’s hierarchical… if you understand the protocol you’re examining it makes perfect sense.

ip.flags.mf==1

the mf bit of the flags field in the ip header is equal to 1…

even easier is to simply right click on the section your interested in  and apply as a filter… it populates the filter field, and just make adjustments as needed…