Wireshark · Wireshark-users: Re: [Wireshark-users] Understanding offset values settings icmp

[Pascal Quantin <pascal.quantin@xxxxxxxxx>]

2015-08-28 11:21 GMT+02:00 asad <a.alii85@xxxxxxxxx>:

Hi Pascal,

Thanks. Also correction its 8 bytes not bits.

Thanks for analysis. However, my original query still remains
unanswered which was how these offset values are calc in first place.
For for 1480 bytes of data the first offset value taking 8-bytes
should be 185. If yes why is same not represented in screen-shot
shown.

Regards,

Hi,

please see my response on ask. No need to duplicate the questions.

Best regards,

Pascal.

On 8/28/15, Pascal Quantin <pascal.quantin@xxxxxxxxx> wrote:
> 2015-08-28 9:35 GMT+02:00 asad <a.alii85@xxxxxxxxx>:
>
>> Sorry, for missing file attachment.
>>
>
> Hi Asad,
>
> I answered your question in the post you put on ask.wireshark.org :
> https://ask.wireshark.org/questions/45438/understanding-offset-values-settings-icmp-fragementation
>
> Best regards,
> Pascal.
>
>
>> On 8/28/15, asad <a.alii85@xxxxxxxxx> wrote:
>> > Hello,
>> >
>> > A certain wireshark sample for icmp fragmentation (attached) is
>> > showing following :-
>> >
>> > -fragment offset:13bits
>> > -offset value ordering as :-
>> >         - 0
>> >         - 1480
>> >         - 2960
>> >
>> > -length 1518.
>> >
>> > From , theory I know usual 8 bytes of offset field will start

>> > calculating offset from 0, then for 1400 bytes of data (minus the
>> > headers) next value be 1400/8. If I apply same concept to attached
>> > pcap It doesn't add up. Why offset values so different even when
>> > considering 1500 bytes of data.
>> >
>> > Thanks.
>> >
>>
>> ___________________________________________________________________________
>> Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
>> Archives:    https://www.wireshark.org/lists/wireshark-users
>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>>              mailto:wireshark-users-request@xxxxxxxxxxxxx
>> ?subject=unsubscribe
>>
>
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe