Estef Posted October 10, 2011 Share Posted October 10, 2011 I am taking a TCP/IP Course and we have to do some Hands on Project. However i am stuck on one of them since it is asking me to find my networks maximum packer size (including headers). Then i asks me to find the overhead of the data link layer header and trailer,the overhead of the IP header, and the overhead of an ICMP header in the Echo request packet. I am using Etheral to capture the packets but i dont know where to look to find this. If someone here has a clue, please help me out. Thanks alot. Quote Link to comment Share on other sites More sharing options...
Mr-Protocol Posted October 10, 2011 Share Posted October 10, 2011 I think the first course of action would be to upgrade your packet sniffer to the newest Wireshark instead of the old old old Ethereal. Next step would be to think logically and do some math. This definition may help: The MTU is the maximum payload length for a particular transmission media. For example, the MTU for Ethernet is typically 1500 bytes. (The maximum packet length for Ethernet is typically 1518 bytes, but that includes 14 bytes of Ethernet header and 4 bytes of CRC, leaving 1500 bytes of payload.) If a host wishes to send packet larger than the MTU for a network, the packet must be broken up into chunks no larger than the MTU. Quote Link to comment Share on other sites More sharing options...
niels Posted October 17, 2011 Share Posted October 17, 2011 Doesn't the IP Protocol allow a MTU up to 65,515 bytes ? Or am I making a mistake here ? Quote Link to comment Share on other sites More sharing options...
Infiltrator Posted October 17, 2011 Share Posted October 17, 2011 Doesn't the IP Protocol allow a MTU up to 65,515 bytes ? Or am I making a mistake here ? MTU maximum transmission rate is 1500 bytes. Whereas the largest data payload of an IP packet that conforms to TCP/IP standards is 65,515 bytes. Quote Link to comment Share on other sites More sharing options...
hexophrenic Posted October 17, 2011 Share Posted October 17, 2011 MTU is not necessarily 1500 bytes. That is the RFC default ethernet MTU. If jumbo frames are enabled MTUs can be quite a bit higher. 4k and 9k MTUs are commonly used in gigabit networks and up to 64k is possible, though not used at this time. To test for this manually, you can issue ping -f -l x hostname or ip. The options -f will disallow fragmentation, -l will denote the size you wish to test. There are other ways, though, like using tcp optimizer from speedguide (http://www.speedguide.net/downloads.php) or others. It is set in the registry, other by your network card drivers properties. Quote Link to comment Share on other sites More sharing options...
digip Posted October 17, 2011 Share Posted October 17, 2011 MTU is not necessarily 1500 bytes. That is the RFC default ethernet MTU. If jumbo frames are enabled MTUs can be quite a bit higher. 4k and 9k MTUs are commonly used in gigabit networks and up to 64k is possible, though not used at this time. To test for this manually, you can issue ping -f -l x hostname or ip. The options -f will disallow fragmentation, -l will denote the size you wish to test. There are other ways, though, like using tcp optimizer from speedguide (http://www.speedguide.net/downloads.php) or others. It is set in the registry, other by your network card drivers properties. From what I understand, I think you want to set it to NOT fragment, and see at what point the packets fail. You have to specify the bytes sent, starting small and working your way up until packets start failing. This is only a rough guess for Path MTU though. Reason being, some protocols will have their own MTU and implement a maximum packet size ahead of sending, depending on the protocol in use and if its encapsulated over another protocol like PPP, which adds additional bytes to the header and such. Its more or less a crapshoot. Quote Link to comment Share on other sites More sharing options...
hexophrenic Posted October 17, 2011 Share Posted October 17, 2011 You are right, which is why I specified -f. As I stated, -f will DISALLOW fragmentation. Quote Link to comment Share on other sites More sharing options...
digip Posted October 17, 2011 Share Posted October 17, 2011 You are right, which is why I specified -f. As I stated, -f will DISALLOW fragmentation. I totally misread your first post and thought you said to fragment it. Thats my bad. ;) Quote Link to comment Share on other sites More sharing options...
hexophrenic Posted October 17, 2011 Share Posted October 17, 2011 No worries man, just did not want OP confused. Quote Link to comment Share on other sites More sharing options...
Infiltrator Posted October 18, 2011 Share Posted October 18, 2011 MTU is not necessarily 1500 bytes. That is the RFC default ethernet MTU. If jumbo frames are enabled MTUs can be quite a bit higher. 4k and 9k MTUs are commonly used in gigabit networks and up to 64k is possible, though not used at this time. To test for this manually, you can issue ping -f -l x hostname or ip. The options -f will disallow fragmentation, -l will denote the size you wish to test. There are other ways, though, like using tcp optimizer from speedguide (http://www.speedguide.net/downloads.php) or others. It is set in the registry, other by your network card drivers properties. I haven't considered Jumbo frames as the OP was only asking about MTU. However depending on your internet service, I think the maximum MTU you can transmit is 1500 bytes or less, over that will need to be fragmented. It would be a good test to try out and see what happens. Quote Link to comment Share on other sites More sharing options...
hexophrenic Posted October 18, 2011 Share Posted October 18, 2011 I just included it since the OP mentioned he had to find it on his network, which if he were on a large campus it may in fact support jumbo frames. Since he is also looking at datalink layer, it would preclude the MSS header options in layer 4. Sorry if I am being pedantic as I am a network guy by nature, and probably have a touch of Asperger's. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.