After the last Packet Challenge I received questions from a couple of individuals about viewing fragments in tcpdump and Wireshark.
To view the IP ID, the More Fragments Flag, and the Fragment Offset in tcpdump use the -v switch:
tcpdump -v
The -v switch stands for verbose. For even more detailed information add another one or two v’s:
tcpdump -vv or tcpdump -vvv
Wireshark by default reassembles fragments. To change this default behavior edit the preferences. In the Edit menu, select Preferences, expand the Protocols section, select IP, and uncheck the Reassemble fragmented IP datagrams checkbox.
For more information on Fragmentation the following is a link to The TCP/IP Guide section on the IP Message Fragmentation Process:
The TCP/IP Guide – IP Message Fragmentation Process
Leave a Comment so far
Leave a comment
I Smell Packets 