IP分片

实验环境搭建

  配置一台虚拟机。本次实验中主机的IP地址为192.168.182.1，虚拟机的IP地址为192.168.182.133。
  通过主机ping虚拟机，指令如下：

ping -l 3000 192.168.182.133

-l 指定包的数据大小为3000字节，使之分片传输。

Wireshark抓包

---

第一帧IP层内容如下：

Internet Protocol Version 4, Src: 192.168.182.1, Dst: 192.168.182.133
0100 … = Version: 4
… 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
Total Length: 1500
Identification: 0x42c6 (17094)
Flags: 0x2000, More fragments
0… … … … = Reserved bit: Not set
.0… … … … = Don’t fragment: Not set
…1. … … … = More fragments: Set
…0 0000 0000 0000 = Fragment offset: 0
Time to live: 128
Protocol: ICMP (1)
Header checksum: 0xe482 [validation disabled]
[Header checksum status: Unverified]
Source: 192.168.182.1
Destination: 192.168.182.133
Reassembled IPv4 in frame: 2048
Data (1480 bytes)
Data: 0800cfc70001000a6162636465666768696a6b6c6d6e6f70…
[Length: 1480]

  注意到标志字段（Flags），DF位=0即允许分片，MF=1即之后还有分片。Fragment offset由于是第一帧，所以偏移为0。

---

第二帧IP层内容如下：

Internet Protocol Version 4, Src: 192.168.182.1, Dst: 192.168.182.133
0100 … = Version: 4
… 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
Total Length: 1500
Identification: 0x42c6 (17094)
Flags: 0x20b9, More fragments
0… … … … = Reserved bit: Not set
.0… … … … = Don’t fragment: Not set
…1. … … … = More fragments: Set
…0 0000 1011 1001 = Fragment offset: 185
Time to live: 128
Protocol: ICMP (1)
Header checksum: 0xe3c9 [validation disabled]
[Header checksum status: Unverified]
Source: 192.168.182.1
Destination: 192.168.182.133
Reassembled IPv4 in frame: 2048
Data (1480 bytes)
Data: 6162636465666768696a6b6c6d6e6f707172737475767761…
[Length: 1480]

注意到第二帧的Fragment offset，偏移以8个字节为单位。第一帧去掉以太网头部和IP头部，剩余1480字节=185*8字节。

---

第三帧IP层内容如下：

Internet Protocol Version 4, Src: 192.168.182.1, Dst: 192.168.182.133
0100 … = Version: 4
… 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
Total Length: 68
Identification: 0x42c6 (17094)
Flags: 0x0172
0… … … … = Reserved bit: Not set
.0… … … … = Don’t fragment: Not set
…0. … … … = More fragments: Not set
…0 0001 0111 0010 = Fragment offset: 370
Time to live: 128
Protocol: ICMP (1)
Header checksum: 0x08a9 [validation disabled]
[Header checksum status: Unverified]
Source: 192.168.182.1
Destination: 192.168.182.133
[3 IPv4 Fragments (3008 bytes): #2046(1480), #2047(1480), #2048(48)]
Internet Control Message Protocol

最后一帧的MF位=0即之后没有分片了。由于第二帧去掉以太网头部和IP头部，剩余1480字节，所以Fragment offset=370=185+185。