Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.
Wireshark logo

Wireshark-users: Re: [Wireshark-users] Ping data size

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: "RUOFF LARS" <Lars.Ruoff@xxxxxxxxxxxxxxxxx>
Date: Tue, 24 Mar 2009 16:17:55 +0100
The solution to the mystery is in frame 14!
http://en.wikipedia.org/wiki/IP_fragmentation
 
regards,
Lars
 



________________________________

	From: wireshark-users-bounces@xxxxxxxxxxxxx
[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Gustavo Vera
Heredia
	Sent: mardi 24 mars 2009 16:01
	To: wireshark-users@xxxxxxxxxxxxx
	Subject: [Wireshark-users] Ping data size
	
	
	Hi all members,
	
	I wonder if you could explain me why this happens: I ping from
one computer to another one in my network. My ping data size is 2000
bytes but I see that the frames containing the ping request and reply
have only 562 bytes, why not 2000??. Why is that? 
	
	This is what I can see:
	
	Frame 13 (562 bytes on wire, 562 bytes captured)
	Ethernet II, Src: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59), Dst:
RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
	Destination: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
	Source: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
	Type: IP (0x0800)
	Internet Protocol, Src: 10.24.4.13 (10.24.4.13), Dst: 10.24.4.16
(10.24.4.16)
	Internet Control Message Protocol
	Type: 8 (Echo (ping) request)
	Code: 0 
	Checksum: 0xb577 [correct]
	Identifier: 0x0200
	Sequence number: 0xc400
	Data (2000 bytes)
	Frame (562 bytes):
	
	Frame 14 (1514 bytes on wire, 1514 bytes captured)
	Ethernet II, Src: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2), Dst:
RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
	Destination: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
	Source: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
	Type: IP (0x0800)
	Internet Protocol, Src: 10.24.4.16 (10.24.4.16), Dst: 10.24.4.13
(10.24.4.13)
	Data (1480 bytes)
	
	Frame 15 (562 bytes on wire, 562 bytes captured)
	Ethernet II, Src: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2), Dst:
RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
	Destination: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
	Source: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
	Type: IP (0x0800)
	Internet Protocol, Src: 10.24.4.16 (10.24.4.16), Dst: 10.24.4.13
(10.24.4.13)
	Internet Control Message Protocol
	Type: 0 (Echo (ping) reply)
	Code: 0 
	Checksum: 0xbd77 [correct]
	Identifier: 0x0200
	Sequence number: 0xc400
	Data (2000 bytes)
	Frame (562 bytes):
	 
	(following frames)
	 
	Frame 16 (60 bytes on wire, 60 bytes captured)
	IEEE 802.3 Ethernet 
	Logical-Link Control
	Spanning Tree Protocol
	...
	
	 
	No.     Time        Source                Destination
Protocol Info
	     17 2.759099    RealtekS_a3:41:b3     Broadcast
ARP      Who has 10.24.4.62?  Tell 10.24.4.11
	Frame 17 (60 bytes on wire, 60 bytes captured)
	Ethernet II, Src: RealtekS_a3:41:b3 (00:e0:4c:a3:41:b3), Dst:
Broadcast (ff:ff:ff:ff:ff:ff)
	    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
	    Source: RealtekS_a3:41:b3 (00:e0:4c:a3:41:b3)
	    Type: ARP (0x0806)
	    Trailer: 839501100001000000000000204641464B46
	Address Resolution Protocol (request)
	    Hardware type: Ethernet (0x0001)
	    Protocol type: IP (0x0800)
	    Hardware size: 6
	    Protocol size: 4
	    Opcode: request (0x0001)
	    Sender MAC address: RealtekS_a3:41:b3 (00:e0:4c:a3:41:b3)
	    Sender IP address: 10.24.4.11 (10.24.4.11)
	    Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
	    Target IP address: 10.24.4.62 (10.24.4.62)
	 
	 
	No.     Time        Source                Destination
Protocol Info
	     18 2.842990    RealtekS_a4:d4:10     Broadcast
ARP      Who has 10.24.4.62?  Tell 10.24.4.14
	Frame 18 (60 bytes on wire, 60 bytes captured)
	Ethernet II, Src: RealtekS_a4:d4:10 (00:e0:4c:a4:d4:10), Dst:
Broadcast (ff:ff:ff:ff:ff:ff)
	    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
	    Source: RealtekS_a4:d4:10 (00:e0:4c:a4:d4:10)
	    Type: ARP (0x0806)
	    Trailer: 80D201100001000000000000204646444444
	Address Resolution Protocol (request)
	    Hardware type: Ethernet (0x0001)
	    Protocol type: IP (0x0800)
	    Hardware size: 6
	    Protocol size: 4
	    Opcode: request (0x0001)
	    Sender MAC address: RealtekS_a4:d4:10 (00:e0:4c:a4:d4:10)
	    Sender IP address: 10.24.4.14 (10.24.4.14)
	    Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
	    Target IP address: 10.24.4.62 (10.24.4.62)
	 

	No.     Time        Source                Destination
Protocol Info
	     19 2.931289    RealtekS_a5:9e:5d     Broadcast
ARP      Who has 10.24.4.62?  Tell 10.24.4.17
	Frame 19 (60 bytes on wire, 60 bytes captured)
	Ethernet II, Src: RealtekS_a5:9e:5d (00:e0:4c:a5:9e:5d), Dst:
Broadcast (ff:ff:ff:ff:ff:ff)
	    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
	    Source: RealtekS_a5:9e:5d (00:e0:4c:a5:9e:5d)
	    Type: ARP (0x0806)
	    Trailer: 81A701100001000000000000204646444444
	Address Resolution Protocol (request)
	    Hardware type: Ethernet (0x0001)
	    Protocol type: IP (0x0800)
	    Hardware size: 6
	    Protocol size: 4
	    Opcode: request (0x0001)
	    Sender MAC address: RealtekS_a5:9e:5d (00:e0:4c:a5:9e:5d)
	    Sender IP address: 10.24.4.17 (10.24.4.17)
	    Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
	    Target IP address: 10.24.4.62 (10.24.4.62)

	 
	 
	No.     Time        Source                Destination
Protocol Info
	     20 3.045996    RealtekS_a4:d2:ff     Broadcast
ARP      Who has 10.24.4.62?  Tell 10.24.4.10
	Frame 20 (60 bytes on wire, 60 bytes captured)
	Ethernet II, Src: RealtekS_a4:d2:ff (00:e0:4c:a4:d2:ff), Dst:
Broadcast (ff:ff:ff:ff:ff:ff)
	    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
	    Source: RealtekS_a4:d2:ff (00:e0:4c:a4:d2:ff)
	    Type: ARP (0x0806)
	    Trailer: 3C016A105018FAB47DF8000085000000FF53
	Address Resolution Protocol (request)
	    Hardware type: Ethernet (0x0001)
	    Protocol type: IP (0x0800)
	    Hardware size: 6
	    Protocol size: 4
	    Opcode: request (0x0001)
	    Sender MAC address: RealtekS_a4:d2:ff (00:e0:4c:a4:d2:ff)
	    Sender IP address: 10.24.4.10 (10.24.4.10)
	    Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
	    Target IP address: 10.24.4.62 (10.24.4.62)
	..
	
	 
	No.     Time        Source                Destination
Protocol Info
	     21 3.100425    10.24.4.13            10.24.4.16
IP       Fragmented IP protocol (proto=ICMP 0x01, off=0) [Reassembled in
#22]
	Frame 21 (1514 bytes on wire, 1514 bytes captured)
	Ethernet II, Src: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59), Dst:
RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
	    Destination: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
	    Source: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
	    Type: IP (0x0800)
	Internet Protocol, Src: 10.24.4.13 (10.24.4.13), Dst: 10.24.4.16
(10.24.4.16)
	Data (1480 bytes)
	
	 
	No.     Time        Source                Destination
Protocol Info
	     22 3.100451    10.24.4.13            10.24.4.16
ICMP     Echo (ping) request
	Frame 22 (562 bytes on wire, 562 bytes captured)
	Ethernet II, Src: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59), Dst:
RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
	    Destination: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
	    Source: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
	    Type: IP (0x0800)
	Internet Protocol, Src: 10.24.4.13 (10.24.4.13), Dst: 10.24.4.16
(10.24.4.16)
	Internet Control Message Protocol
	    Type: 8 (Echo (ping) request)
	    Code: 0 
	    Checksum: 0xb477 [correct]
	    Identifier: 0x0200
	    Sequence number: 0xc500
	    Data (2000 bytes)
	Frame (562 bytes):
	...
	
	No.     Time        Source                Destination
Protocol Info
	  23 3.101207    10.24.4.16            10.24.4.13            IP
Fragmented IP protocol (proto=ICMP 0x01, off=0) [Reassembled in #24]
	Frame 23 (1514 bytes on wire, 1514 bytes captured)
	Ethernet II, Src: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2), Dst:
RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
	    Destination: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
	    Source: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
	    Type: IP (0x0800)
	Internet Protocol, Src: 10.24.4.16 (10.24.4.16), Dst: 10.24.4.13
(10.24.4.13)
	Data (1480 bytes)
	 
	No.     Time        Source                Destination
Protocol Info
	     24 3.101222    10.24.4.16            10.24.4.13
ICMP     Echo (ping) reply
	Frame 24 (562 bytes on wire, 562 bytes captured)
	Ethernet II, Src: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2), Dst:
RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
	    Destination: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
	    Source: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
	    Type: IP (0x0800)
	Internet Protocol, Src: 10.24.4.16 (10.24.4.16), Dst: 10.24.4.13
(10.24.4.13)
	Internet Control Message Protocol
	    Type: 0 (Echo (ping) reply)
	    Code: 0 
	    Checksum: 0xbc77 [correct]
	    Identifier: 0x0200
	    Sequence number: 0xc500
	    Data (2000 bytes)
	Frame (562 bytes):
	...
	No.     Time        Source                Destination
Protocol Info
	     25 3.760546    RealtekS_a3:41:b3     Broadcast
ARP      Who has 10.24.4.62?  Tell 10.24.4.11
	Frame 25 (60 bytes on wire, 60 bytes captured)
	Ethernet II, Src: RealtekS_a3:41:b3 (00:e0:4c:a3:41:b3), Dst:
Broadcast (ff:ff:ff:ff:ff:ff)
	    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
	    Source: RealtekS_a3:41:b3 (00:e0:4c:a3:41:b3)
	    Type: ARP (0x0806)
	    Trailer: 6162636465666768696A6B6C6D6E6F707172
	Address Resolution Protocol (request)
	    Hardware type: Ethernet (0x0001)
	    Protocol type: IP (0x0800)
	    Hardware size: 6
	    Protocol size: 4
	    Opcode: request (0x0001)
	    Sender MAC address: RealtekS_a3:41:b3 (00:e0:4c:a3:41:b3)
	    Sender IP address: 10.24.4.11 (10.24.4.11)
	    Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
	    Target IP address: 10.24.4.62 (10.24.4.62)
	 

	No.     Time        Source                Destination
Protocol Info
	     26 3.999347    RealtekS_c2:f4:69     Broadcast
ARP      Who has 10.23.3.62?  Tell 10.23.3.15
	Frame 26 (60 bytes on wire, 60 bytes captured)
	Ethernet II, Src: RealtekS_c2:f4:69 (00:e0:4c:c2:f4:69), Dst:
Broadcast (ff:ff:ff:ff:ff:ff)
	    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
	    Source: RealtekS_c2:f4:69 (00:e0:4c:c2:f4:69)
	    Type: ARP (0x0806)
	    Trailer: 83F9AD86000000010000000020454D454245
	Address Resolution Protocol (request)
	    Hardware type: Ethernet (0x0001)
	    Protocol type: IP (0x0800)
	    Hardware size: 6
	    Protocol size: 4
	    Opcode: request (0x0001)
	    Sender MAC address: RealtekS_c2:f4:69 (00:e0:4c:c2:f4:69)
	    Sender IP address: 10.23.3.15 (10.23.3.15)
	    Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
	    Target IP address: 10.23.3.62 (10.23.3.62)

	No.     Time        Source                Destination
Protocol Info
	     27 4.101803    10.24.4.13            10.24.4.16
IP       Fragmented IP protocol (proto=ICMP 0x01, off=0) [Reassembled in
#28]
	Frame 27 (1514 bytes on wire, 1514 bytes captured)
	Ethernet II, Src: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59), Dst:
RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
	    Destination: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
	    Source: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
	    Type: IP (0x0800)
	Internet Protocol, Src: 10.24.4.13 (10.24.4.13), Dst: 10.24.4.16
(10.24.4.16)
	Data (1480 bytes)
	....
	No.     Time        Source                Destination
Protocol Info
	     28 4.101824    10.24.4.13            10.24.4.16
ICMP     Echo (ping) request
	Frame 28 (562 bytes on wire, 562 bytes captured)
	Ethernet II, Src: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59), Dst:
RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
	    Destination: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
	    Source: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
	    Type: IP (0x0800)
	Internet Protocol, Src: 10.24.4.13 (10.24.4.13), Dst: 10.24.4.16
(10.24.4.16)
	Internet Control Message Protocol
	    Type: 8 (Echo (ping) request)
	    Code: 0 
	    Checksum: 0xb377 [correct]
	    Identifier: 0x0200
	    Sequence number: 0xc600
	    Data (2000 bytes)
	Frame (562 bytes):
	
	
	Thanks in advance!!!
Wireshark logo footer

© Wireshark Foundation · Privacy Policy

Facebook·Mastodon·Twitter·YouTube