Hello,
A certain wireshark sample for icmp fragmentation (attached) is
showing following :-
-fragment offset:13bits
-offset value ordering as :-
- 0
- 1480
- 2960
-length 1518.
>From , theory I know usual 8 bits of offset field will start
calculating offset from 0, then for 1400 bytes of data (minus the
headers) next value be 1400/8. If I apply same concept to attached
pcap It doesn't add up. Why offset values so different even when
considering 1500 bytes of data.
Thanks.
Attachment:
phpmlKtjJ
Description: Binary data
