Re: Understanding offset values settings icmp

[Pascal Quantin <pascal.quantin () gmail com>]

2015-08-28 11:21 GMT+02:00 asad <a.alii85 () gmail com>:

> Hi Pascal,
>
> Thanks. Also correction its 8 bytes not bits.
>
> Thanks for analysis. However, my original query still remains
> unanswered which was how these offset values are calc in first place.
> For for 1480 bytes of data the first offset value taking 8-bytes
> should be 185. If yes why is same not represented in screen-shot
> shown.
>
> Regards,
Hi,

please see my response on ask. No need to duplicate the questions.

Best regards,
Pascal.


> On 8/28/15, Pascal Quantin <pascal.quantin () gmail com> wrote:
> > 2015-08-28 9:35 GMT+02:00 asad <a.alii85 () gmail com>:
> >
> > > Sorry, for missing file attachment.
> >
> > Hi Asad,
> >
> > I answered your question in the post you put on ask.wireshark.org :
> https://ask.wireshark.org/questions/45438/understanding-offset-values-settings-icmp-fragementation
> > Best regards,
> > Pascal.
> >
> >
> > > On 8/28/15, asad <a.alii85 () gmail com> wrote:
> > > > Hello,
> > > >
> > > > A certain wireshark sample for icmp fragmentation (attached) is
> > > > showing following :-
> > > >
> > > > -fragment offset:13bits
> > > > -offset value ordering as :-
> > > >         - 0
> > > >         - 1480
> > > >         - 2960
> > > >
> > > > -length 1518.
> > > >
> > > > From , theory I know usual 8 bytes of offset field will start
> > > > calculating offset from 0, then for 1400 bytes of data (minus the
> > > > headers) next value be 1400/8. If I apply same concept to attached
> > > > pcap It doesn't add up. Why offset values so different even when
> > > > considering 1500 bytes of data.
> > > >
> > > > Thanks.
> ___________________________________________________________________________
> > > Sent via:    Wireshark-users mailing list <
> wireshark-users () wireshark org>
> > > Archives:    https://www.wireshark.org/lists/wireshark-users
> > > Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> > >              mailto:wireshark-users-request () wireshark org
> > > ?subject=unsubscribe
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
> Archives:    https://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>              mailto:wireshark-users-request () wireshark org
> ?subject=unsubscribe
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe