SubnetLayerProtocols

When a Packet Is Too Big

Fragmentation, Don't Fragment, and the failure that only affects large transfers

Step 1 of 2 — understand the idea. Read this first and the packet trace will confirm what you already expect, instead of teaching you two things at once.

What you'll be able to do

Before this lesson — it builds directly on:
Every kind of link has a maximum packet size — its MTU. Ethernet's is normally 1500 bytes. Why have a limit? Because a link is shared. One enormous packet would monopolise it while everything else waited, and a single error would destroy the whole thing rather than one small piece. The difficulty is that a packet may cross many links, and it has no way of knowing which is smallest before it sets out.

✗ Common misunderstanding: If some fragments arrive, the receiver gets that much of the data.

Why that's wrong: Reassembly is all or nothing. One missing fragment discards the entire datagram, however many arrived.

Correct model: Fragmenting into four pieces gives loss four chances to destroy the whole datagram, not one chance to damage a quarter of it.

The packets prove it: The reassembly notes in the fragmentation trace show the buffer holding pieces and delivering nothing until the last one lands.

Watch these fields in the lab: ipv4.totalLength

  1. 1A router receives a packet and looks up where to send it next.
  2. 2It compares the packet's size with the MTU of the outgoing link.
  3. 3If it fits, it forwards it unchanged (bar TTL) and nothing else happens.
  4. 4If it does not fit and Don't Fragment is clear, the router cuts it into pieces, copying the identification to each, numbering their offsets in 8-byte units, and setting More Fragments on all but the last.
  5. 5If it does not fit and Don't Fragment is set, the router may not split it. It discards the packet and reports ICMP fragmentation-needed, naming the MTU that would have worked.
  6. 6The destination holds arriving fragments in a reassembly buffer until the set is complete, then hands the rebuilt datagram up. The layer above never learns it travelled in pieces.
  7. 7If any fragment is missing when the reassembly timer expires, everything held is discarded.

Watch these fields in the lab: ipv4.flags.dontFragment · ipv4.flags.moreFragments · ipv4.fragmentOffset

✓ Concept check — before you open the packets

These test the idea, not the trace. You should be able to answer them from the explanation above.

Why must every fragment except the last carry a multiple of 8 bytes?

A VPN is deployed. Users report that most things work but file uploads hang. What is the first thing to check?

Now that you understand the concept, observe how it appears in the packet exchange.

The lab runs a real simulated capture — pause, step, click any packet, and inspect every byte.