Course: COMP347 Computer Networks (Revision 10) | Textbook: Kurose & Ross, Computer Networking: A Top‑Down Approach (9th ed.)
Upon completion of this tutorial, students should be able to:
Different networks use different Maximum Transmission Units (MTUs) – the maximum size of a frame that can be transmitted on a link. The most common MTU is 1500 bytes for Ethernet. When an IPv4 datagram is larger than the MTU of the outgoing link, the router must fragment the datagram into smaller pieces that fit within the link's MTU. This process is called fragmentation. The fragments are reassembled at the destination host.
Fragmentation is a key data‑plane function that allows IP to operate over heterogeneous networks with varying link capacities. However, fragmentation introduces overhead, increases latency, and can be used as a vector for security attacks. This tutorial covers the mechanics of fragmentation, the calculation of fragment offsets, reassembly, the DF flag, Path MTU Discovery, and security issues. Understanding fragmentation is essential for network troubleshooting and performance analysis.
The MTU is the maximum size of a packet (including all headers) that can be transmitted in a single frame over a physical link. Common MTU values:
| Network Technology | MTU (bytes) |
|---|---|
| Ethernet (standard) | 1500 |
| Ethernet with Jumbo Frames | 9000 |
| IEEE 802.11 (Wi‑Fi) | 2304 |
| ATM (AAL5) | 9180 |
| PPP (typically) | 1500 |
| Frame Relay | 1600+ |
When a router receives a datagram destined for an interface with a smaller MTU than the datagram size, it must either fragment the datagram (if the DF flag is not set) or discard it and send an ICMP Fragmentation Needed message back to the source.
Fragmentation splits the original datagram into one or more fragments, each with its own IP header. The process is as follows:
Note: Routers do not reassemble fragments; reassembly is done only at the final destination host.
When fragments arrive at the destination, the IP layer reassembles them:
The Fragment Offset field is 13 bits, so it can represent offsets up to 2^13 = 8192 units. Each unit is 8 bytes, so the maximum offset is 8192 * 8 = 65,536 bytes, matching the maximum datagram size. The offset indicates the position of the fragment's data in multiples of 8 bytes relative to the start of the original payload.
Example: Original datagram of 4000 bytes (payload = 3980 bytes, header 20). MTU = 1500 bytes. Max payload per fragment = 1500 - 20 = 1480 bytes. 1480 / 8 = 185, which is an integer. So fragments:
There are 3 flag bits: Reserved (0), DF (Don't Fragment), and MF (More Fragments).
The Identification field (16 bits) is used to uniquely identify a datagram for fragmentation purposes. When a datagram is fragmented, all fragments carry the same Identification value. The source host increments this field for each datagram it sends. Reassembly uses (source, destination, protocol, ID) to group fragments.
Fragmentation introduces several overheads:
Because of these issues, many applications use Path MTU Discovery (PMTUD) to avoid fragmentation.
PMTUD is a technique used to determine the minimum MTU along a path between two hosts. It works by setting the DF flag and sending datagrams of increasing size. When a router encounters a datagram that is too large, it drops it and sends an ICMP Fragmentation Needed (type 3, code 4) message back to the source, indicating the MTU of the next hop. The source then reduces its datagram size accordingly. PMTUD is widely used by TCP to avoid fragmentation and improve performance.
However, PMTUD can be broken if ICMP messages are filtered by firewalls, leading to the "black hole" problem where packets are silently dropped. Solutions include using MSS clamping or enabling PMTUD on firewalls.
Fragmentation can be exploited in various attacks:
Modern firewalls often perform fragment reassembly before applying security policies, and operating systems have patches to prevent known attacks.
IPv6 fragmentation: In IPv6, fragmentation is not performed by intermediate routers; instead, it is the responsibility of the source host (using the Fragment extension header). The DF flag does not exist in IPv6; instead, the path MTU is discovered, and if the packet is too large, the host fragments it. This simplifies router forwarding.
RFC 791 vs. 8200: IPv4 fragmentation is defined in RFC 791, while IPv6 fragmentation is defined in RFC 8200. The IPv6 approach reduces router processing and ensures that fragmentation is handled end‑to‑end.
Application impact: Applications like VoIP and video streaming may suffer from fragmentation due to jitter and loss. Many use UDP and must handle fragmentation carefully. Some applications prefer to keep datagrams small (e.g., VPNs with encapsulation).
Q1. The Maximum Transmission Unit (MTU) is defined as:
B)
Q2. Which IPv4 header field is used to identify fragments belonging to the same original datagram?
B)
Q3. The Fragment Offset field is measured in:
B) 8‑byte units.
Q4. Which flag indicates that a datagram should not be fragmented?
B) DF
Q5. In IPv4 fragmentation, which field is NOT changed when a router fragments a datagram?
D) Source Address remains the same, as does destination address, protocol, and identification.
Q6. What does the MF flag set to 1 indicate?
B)
Q7. The total length of an IPv4 fragment includes:
B)
Q8. Reassembly of IP fragments is performed at:
B) Only the destination host
Q9. If the DF flag is set and a router needs to fragment a datagram, what happens?
B) It sends ICMP type 3, code 4.
Q10. Path MTU Discovery (PMTUD) uses which field to prevent fragmentation?
B) DF is set to trigger ICMP Fragmentation Needed messages.
Q11. The maximum fragment offset value (in bytes) is approximately:
A) 65,535 (since max offset is 8192 units * 8 = 65536, but the maximum datagram size is 65535, so effectively 65528?). Actually the maximum offset that can be represented is 8191 (2^13-1) * 8 = 65528, but the total length field limits the datagram to 65535. So the maximum offset is 65528. But many sources say 65528. However, the question likely expects 65535 as approximate. We'll choose the closest: 65,535 is the max datagram size, but offset cannot reach that. Better to say 65,528 is the maximum offset. I'll adjust answer: 65,528.
Q12. An ICMP Fragmentation Needed message includes the MTU of the next hop in the payload. This is used by:
A) The source host uses this to set the maximum datagram size for future packets.
Q13. Which of the following is NOT a problem caused by IP fragmentation?
C) Fragmentation actually complicates router processing (they must fragment).
Q14. In IPv6, fragmentation is:
B) Performed by the source host only (using extension headers).
Q15. The reassembly timer at the destination is typically set to:
C) 60 seconds (typical; may vary).
Q16. When fragmenting a datagram, the payload size of each fragment must be a multiple of:
B) 8 bytes because offset is in 8‑byte units.
Q17. In IPv4, the default header length is 20 bytes. If the MTU is 1500, the maximum payload per fragment (without options) is:
A) 1480 (1500 - 20).
Q18. The Identification field in IPv4 is 16 bits. How many unique datagrams can be identified?
B) 65,536 (2^16).
Q19. Which of the following is a security attack that exploits IP fragmentation?
B) Teardrop attack uses overlapping fragments.
Q20. In IPv4, if a fragment is lost, the transport layer (e.g., TCP) must retransmit:
C) The entire segment (i.e., the entire TCP segment is retransmitted, which may be larger than the datagram).
Q21. What is the primary motivation for avoiding IP fragmentation?
D) All of the above
Q22. The DF flag is set in which scenario?
B)
Q23. If the total length of a fragment is 1000 bytes and the IP header is 20 bytes, what is the payload size?
B) 980
Q24. The ICMP message "Fragmentation Needed" has code:
C) 4 (type 3, code 4).
Q25. In IPv4, the Fragment Offset field is 13 bits. What is the maximum offset value in units of 8 bytes?
A) 8191 (2^13 - 1).
Q26. Which of the following scenarios would cause a router to fragment an IP packet?
B)
Q27. What is the impact of fragmentation on TCP performance?
B)
Q28. The "black hole" problem in PMTUD occurs when:
B)
Q29. In IPv6, which field replaces the IPv4 Fragment Offset?
B) The Fragment extension header contains the offset.
Q30. When reassembling fragments, what happens if a fragment is missing?
B) After the timer expires, all fragments are discarded.
Q31. The total length of a fragment is 576 bytes, and the header is 20 bytes. The Fragment Offset is 0. What can you say about this fragment?
C) It is the first fragment because offset 0 indicates it starts at the beginning.
Q32. An IP datagram is 4000 bytes (including header). The MTU is 1400. How many fragments are created?
B) 4 (payload = 3980, each fragment payload max = 1400-20=1380, 3980/1380=2.88, so 3 fragments? Let's calculate: 1380*3=4140 >3980, so 3 fragments; but we need to check: 3980/1380=2.884, so 3 fragments. Wait, 3980/1380 = 2.884, so 3 fragments. But let's compute: first two fragments have 1380 payload each, last has 3980-2760=1220 payload. So total 3 fragments. So answer A) 3. Let's adjust: 3 fragments.
Q33. The DF flag is set to 1. A router needs to forward a datagram that is larger than the MTU. The router will:
A)
An IPv4 datagram with a total length of 3000 bytes (including a 20‑byte header) must be sent over a link with an MTU of 700 bytes. How many fragments will be created? What are the fragment offset, MF flag, and total length for each fragment? Assume no options.
Payload = 3000 - 20 = 2980 bytes. MTU 700, header 20, so max payload per fragment = 700 - 20 = 680 bytes. 680 is divisible by 8? 680/8 = 85, yes.
Number of fragments = ceil(2980 / 680) = 5 (since 4*680=2720, 5*680=3400).
Fragments:
1: offset 0, MF=1, total length = 20+680=700
2: offset 85 (680/8), MF=1, total length=700
3: offset 170, MF=1, total length=700
4: offset 255, MF=1, total length=700
5: offset 340, MF=0, total length = 20 + (2980 - 4*680) = 20 + (2980-2720) = 20+260 = 280.
A datagram has the following flags: DF=0, MF=0, Fragment Offset=0, Identification=0x1234, Total Length=400, and the destination receives a fragment with DF=0, MF=1, Fragment Offset=100 (in 8‑byte units), Total Length=200, Identification=0x1234. What can you say about the original datagram? What is missing?
The fragment has offset 100, which corresponds to 800 bytes. Total length 200 means payload = 180 bytes (assuming 20 header). The MF=1 indicates more fragments. The original datagram's payload size is at least 800 + 180 = 980 bytes, plus whatever comes after. Since we only have one fragment, we know the original had other fragments. The Identification matches, so it's from the same datagram.
Explain the purpose of the Fragment Offset field being measured in 8‑byte units. Why not 1‑byte units?
The 13‑bit offset field would only allow 2^13 = 8192 distinct offsets. If measured in bytes, it would limit the datagram to 8192 bytes. By using 8‑byte units, it can represent offsets up to 8192 * 8 = 65,536 bytes, which matches the maximum datagram size. This design allows efficient use of bits while covering the full range.
An IPv4 datagram of 4500 bytes (including a 20‑byte header) is to be transmitted over a network with an MTU of 1500 bytes. Calculate the fragment offset and total length for each fragment, and specify the MF flag.
Payload = 4480 bytes. Max payload per fragment = 1480 bytes (1500‑20). 1480 is divisible by 8? 1480/8=185.
Number of fragments = ceil(4480/1480) = 4 (3*1480=4440, 4*1480=5920).
Fragments:
1: offset 0, MF=1, total length=1500
2: offset 185, MF=1, total length=1500
3: offset 370, MF=1, total length=1500
4: offset 555, MF=0, total length = 20 + (4480 - 3*1480) = 20 + (4480 - 4440) = 20 + 40 = 60.
What is the maximum payload size that can be carried in a single fragment over an Ethernet network (MTU=1500) if the IP header includes 40 bytes of options?
IP header length = 20 (base) + 40 (options) = 60 bytes. Max payload = MTU - header = 1500 - 60 = 1440 bytes. This must be a multiple of 8; 1440/8=180, so it is valid.
Explain the concept of "IP reassembly timeout" and why it is necessary.
When fragments arrive, the destination must wait for all fragments to arrive. If some fragments are lost, the destination cannot reassemble. To avoid waiting indefinitely, a timer (typically 60 seconds) is set. If the timer expires before all fragments arrive, the fragments are discarded, and the original datagram is considered lost. This prevents resource exhaustion.
A datagram of 8000 bytes (including header) is sent. The MTU is 1500. Calculate the offset for each fragment and the total number of fragments. How many bytes are transmitted in total including headers?
Payload = 7980 bytes. Max payload per fragment = 1480. Number of fragments = ceil(7980/1480) = 6 (5*1480=7400, 6*1480=8880).
Fragments: offsets: 0, 185, 370, 555, 740, 925.
Total bytes transmitted = 6 * 1500 = 9000 bytes? Actually the last fragment may be smaller. Let's compute: first five fragments have 1480 payload, total 7400, last payload = 7980-7400=580, last fragment total length = 20+580 = 600. So total bytes = 5*1500 + 600 = 7500+600 = 8100 bytes? Wait, first five fragments: each total length 1500, sum=7500. Last total length 600, total = 8100. The original was 8000, so overhead = 100 bytes (extra headers).
Describe how Path MTU Discovery works in TCP. What happens if ICMP messages are blocked?
TCP sets the DF flag in its IP packets. It starts with a segment size based on the interface MTU. When a router discards a packet due to size, it sends an ICMP Fragmentation Needed message to the source. The source reduces its MSS (Maximum Segment Size) accordingly and retransmits. If ICMP is blocked, the source never receives the message and keeps sending large packets that are silently dropped, leading to connection hang (the "black hole" problem). Solutions include using MSS clamping on routers or enabling PMTUD on firewalls.
A router receives a datagram with the DF flag set to 1, total length 4000 bytes, and the outgoing interface has an MTU of 1400 bytes. What does the router do? What ICMP message, if any, is sent?
The router drops the datagram because DF=1 prevents fragmentation. It sends an ICMP Destination Unreachable (type 3, code 4) message back to the source, indicating that fragmentation is needed but DF is set. The ICMP message includes the MTU of the next hop.
What are the security implications of IP fragmentation? Name two common fragmentation attacks.
Fragmentation can be used to evade firewalls, cause resource exhaustion, or exploit implementation bugs. Attacks: Teardrop (overlapping fragments causing integer overflow), and Fragment Overlap attacks where malicious payloads are split across fragments to bypass inspection.
Compare the fragmentation handling between IPv4 and IPv6. Why did IPv6 change the approach?
In IPv4, routers can fragment; in IPv6, only the source host can fragment using extension headers. IPv6 requires the source to discover the path MTU and send appropriately sized packets. This reduces router complexity, improves forwarding performance, and makes the network core simpler. It also avoids the fragmentation overhead on routers.
A datagram is fragmented into three fragments. The first fragment has MF=1 and offset=0. The second has MF=1 and offset=100 (in 8‑byte units). The third has MF=0 and offset=200. What is the total payload size of the original datagram? Assume header is 20 bytes each.
Fragment 1 offset 0, MF=1, but we don't know its length. Fragment 2 offset 100 means its data starts at 800 bytes. Fragment 3 offset 200 means its data starts at 1600 bytes. So the original payload size is at least the end of the last fragment. If the last fragment has MF=0, its payload size is whatever remains. But without total lengths, we cannot compute exact size. However, the offset values indicate that the first fragment's payload is 800 bytes (since the second starts at 800), and the second fragment's payload is 800 bytes (since third starts at 1600). So total payload = 800 + 800 + (payload of third fragment). The third fragment's payload is its total length minus 20. So total is 1600 + (third payload). Without total length of third, we can't get absolute. But if we assume the third fragment ends at the end, we need its length. Not enough info.
Explain why fragmentation is considered harmful for real‑time applications like VoIP.
Fragmentation increases delay (more packets to process), jitter (fragments may arrive out of order), and loss sensitivity (loss of a single fragment causes the whole packet to be lost). Real‑time applications are sensitive to these effects, so they prefer to avoid fragmentation by using smaller packet sizes or path MTU discovery.
Given an MTU of 1500 and a header of 20 bytes, what is the maximum payload size per fragment? If the original payload is 5000 bytes, how many fragments are needed? What is the fragment offset of the last fragment?
Max payload = 1480. Number of fragments = ceil(5000/1480) = 4 (since 3*1480=4440, 4*1480=5920). Offsets: 0, 185 (1480/8), 370, 555 (for last fragment, offset = 3*185 = 555). Last fragment offset = 555, MF=0.
How does the Identification field help in reassembly? What happens if two different datagrams use the same Identification value?
The Identification field, combined with source and destination addresses and protocol, uniquely identifies the fragments belonging to a specific datagram. If two different datagrams use the same ID, the destination might incorrectly group fragments, causing corruption. However, the ID is usually unique for each datagram sent by a host, and the IP layer can handle this.
Research the history of IPv4 fragmentation and the reasons why IPv6 eliminated router fragmentation. Write a 500‑word essay.
IPv4 fragmentation was designed to accommodate diverse link MTUs. However, it introduced complexity and overhead. IPv6 was designed to simplify router processing by removing the ability for routers to fragment. Instead, hosts must perform PMTUD. This reduces router load, improves performance, and aligns with the end‑to‑end principle. The change also avoids fragmentation attacks at the network core.
Explain the concept of "Path MTU Discovery" and the steps involved in discovering the path MTU for a TCP connection. What are the common issues with PMTUD and how can they be mitigated?
PMTUD works by setting DF flag and sending packets of increasing size until ICMP Fragmentation Needed is received. The source reduces the size. Common issues: ICMP filtering (black hole), asymmetric routing, and firewalls that drop ICMP. Mitigations include using TCP MSS clamping, enabling ICMP on firewalls, and using packetization layer PMTUD (PLPMTUD) which probes without relying on ICMP.
Calculate the total overhead (in bytes) for fragmenting a 9000‑byte datagram (including header) into fragments over a link with MTU 1500. Assume header size 20 bytes. Include all fragment headers.
Payload = 8980 bytes. Max payload per fragment = 1480. Number of fragments = ceil(8980/1480) = 7 (since 6*1480=8880, 7*1480=10360). Total headers = 7 * 20 = 140 bytes. Original header = 20 bytes. Overhead = 140 - 20 = 120 bytes. Total transmitted data = 9000 + 120 = 9120 bytes.
Explain the relationship between MTU, fragmentation, and TCP window size. How does fragmentation affect TCP throughput?
MTU determines the maximum segment size (MSS) for TCP. If fragmentation occurs, each fragment may be lost independently, increasing the chance of retransmission. This reduces goodput. TCP can adapt by reducing the MSS based on PMTUD. Fragmentation also adds overhead, reducing efficiency. Overall, fragmentation can significantly degrade TCP throughput, especially in lossy networks.
Describe the process of reassembly at the destination. Include how the destination knows when all fragments have arrived and what happens if fragments are missing.
Destination uses a reassembly timer and a list of received fragments. It groups fragments by (source, dest, protocol, ID). It orders them by offset. The MF flag indicates the last fragment. When the last fragment arrives, it checks if all offsets are contiguous. If yes, it reassembles; if not, it waits until timer expires. On timeout, it discards all fragments.
Compare the security vulnerabilities of IP fragmentation with those of TCP segmentation. Which is more dangerous and why?
IP fragmentation can be used for evasion (firewalls), resource exhaustion (fragmentation floods), and attacks like teardrop. TCP segmentation is at a higher layer and is handled by the host; it is less likely to be used for network‑level evasion. IP fragmentation is more dangerous because it involves network devices and can bypass security appliances if they don't reassemble fragments.
Given the following fragment headers (all from the same datagram) received at the destination: (ID=0xABCD, offset=0, MF=1, length=500), (ID=0xABCD, offset=50, MF=1, length=500), (ID=0xABCD, offset=100, MF=0, length=300). What is the original payload size? What is the size of the original IP datagram? Assume header size 20.
Offset units: offset 0 means first fragment starts at 0. offset 50 means 50*8=400 bytes. offset 100 means 800 bytes. Fragment 1 payload = 500-20=480. Fragment 2 payload = 500-20=480. Fragment 3 payload = 300-20=280. Total payload = 480 + 480 + 280 = 1240 bytes. Since the last fragment MF=0, total payload is 1240. Total datagram size = payload + header = 1240 + 20 = 1260 bytes.
Explain why the Fragment Offset field must be in multiples of 8 bytes. What would be the maximum datagram size if it were in bytes instead?
If the offset were in bytes, with 13 bits, the maximum offset would be 8191 bytes, limiting the datagram to 8191 bytes. By using 8‑byte units, the offset can represent up to 65528 bytes, which covers the maximum IP datagram size of 65535 bytes. This efficient use of bits allowed for a 16‑bit total length field.
Describe the "fragmentation attack" known as "Teardrop" and how it was mitigated.
Teardrop attack sends overlapping fragments with negative offsets, causing the reassembly code to crash or behave unexpectedly. It was mitigated by patching operating systems to properly handle overlapping fragments and validate offsets.
What is the role of the DF flag in Path MTU Discovery? Explain the procedure using an example.
The DF flag is set to tell routers not to fragment. The source sends a large packet with DF=1. A router with a smaller MTU drops it and sends ICMP Fragmentation Needed with the next hop MTU. The source reduces its packet size and retransmits, eventually finding the path MTU.
Compare and contrast fragmentation in IPv4 and IPv6. Focus on the roles of routers and hosts.
IPv4 allows routers to fragment; IPv6 does not. IPv6 hosts must perform PMTUD and fragment if necessary. IPv6 uses extension headers for fragmentation, with a Fragment header. IPv6 eliminates router fragmentation to improve performance and security.
Explain why fragmentation is considered a performance bottleneck. Provide at least three reasons.
1) Extra header overhead increases bandwidth consumption. 2) Loss of a fragment requires retransmission of the whole datagram (or segment). 3) Reassembly adds processing at the destination. 4) Can increase jitter and delay.
What is the default MTU for Ethernet and for PPPoE? How does PPPoE affect fragmentation?
Ethernet MTU is 1500 bytes. PPPoE adds 8 bytes overhead, reducing the effective MTU to 1492 bytes. This can cause fragmentation if the IP packet is 1500 bytes, leading to performance issues. PMTUD or MSS clamping is often used to adjust.
Research the concept of "atomic fragmentation" and whether it exists in IPv4.
Atomic fragmentation refers to a single fragment that is not further fragmented. In IPv4, every datagram is either fragmented or not. There is no concept of atomic fragmentation; a datagram can be fragmented into multiple pieces.
Given an IPv4 datagram with the following characteristics: Total Length=1500, DF=0, MF=0, Fragment Offset=0, Identification=0x5678. The datagram is sent over a link with MTU=576. How many fragments are created? Show the header fields for each fragment.
Payload = 1500 - 20 = 1480 bytes. MTU 576 means max payload = 576 - 20 = 556 bytes. 556 is divisible by 8? 556/8=69.5, not integer. Must use multiple of 8 less than or equal to 556: 552 (69*8). So max payload per fragment = 552. Number of fragments = ceil(1480/552) = 3 (2*552=1104, 3*552=1656). Fragments: offset 0, MF=1, length=20+552=572; offset 69, MF=1, length=572; offset 138, MF=0, length=20 + (1480-1104) = 20+376 = 396.
This tutorial has provided a thorough examination of IPv4 fragmentation and MTU considerations. Key takeaways:
Understanding fragmentation is crucial for troubleshooting network performance and security issues. In the next tutorial, we will explore Network Address Translation (NAT).