Hi folks,
in my current version (0.8.8 ?) ethereal reports the IP fragment offset as
it stands in the IP header. But the real offset is 8-times that value! I
would very much prefer that ethereal reports me the correct offset, as it
does with the IP header length (e.g. 5 in the header field, but the length
is 5*4=20)
RFC-791 tells us:
Fragment Offset: 13 bits
This field indicates where in the datagram this fragment belongs.
The fragment offset is measured in units of 8 octets (64 bits). The
first fragment has offset zero.
You can simply test that behaviour by a very large ping:
> ping -c 1 -s 2000 www.elsa.com
Unfortunately I don't have that deep knowledge if ethereal's internals to
write a patch. I hope that some of the ethereal experts find will some
minutes to implement that improvement. Thanks to that experts for that
excellent tool.
Kind regards,
Dietmar
---------------------------------------------------------------------------
Dr. Dietmar Petras Senior Expert
ELSA AG Engineering Consumer Communications
Sonnenweg 11 Phone: +49-(0)241-606-4649
52070 Aachen Fax: +49-(0)241-606-4699
Germany EMail: Dietmar.Petras@xxxxxxx
---------------------------------------------------------------------------
