Hello everyone in this lesson. I will tell you the IP fragmentation
and three assembly process.
In order to understand the importance of the IP fragmentation
and TCP segmentation and MTU Concepts.
We will first talk about Network
traffic on an example of topology.
And we will cover the factors that affect Network
performance and CP.
Here, we have a client and a server talking
to each other over the internet and we
are thinking of this browser here as our
client and thinking of the web server this
web server as our server.
Imagine that a user is typing a
website URL such as wireshark.org and
then clicking on the enter button.
As soon as the user hit the enter button, the
browser sends a request package to
the web server.
But before sending the user request here,
we have a process.
A question, which they browser process the
user request this process starts
from the moment. The user clicks on the enter button
and throughout this process the browser spans
sometime to handle it the handle
the request process.
We are calling it as a client time
in this illustration. We can
think of it as a client time which is
spanned for processing the request on the browser. And
this also may be able to affect
the network performance and responsibility experienced
by the user.
So after the browser.
Process the user request it's gonna send the
request to the server.
At this point because the request package
has too much too much size to
fit in a single package.
It may be divided to a number of packages
as you can see here and you can
think of this packages.
as the request pdu 1
that request pdu3 so if the
process that has happened so far is considered
through the OSI model. It's like that
when data is sent from an application to
the network this first pass to
the TCP layer Regional which breaks the data into
smaller chunks called segments each
segment contains a portion
a part of the application date.
Long feet additional information such as
the source and destination port numbers the sequence
number and the acknowledgment number.
So this segments are then passed to
the network layer where they are in capsulated
as packets. So at this
point the data is segmented by TCP.
And sent to the network layer.
And at the network layer, the segments are incapsulated by
IP protocols adding the IP headers.
We are calling each one of them as packets.
We know already our traffics in
Wireshark. We have observed many times
in Wireshark the packets in
the packet this pane as you know, and then
these segmented pdus are sent to
the destination as X.
Is like in here write at
this point when packets are sent over a network.
They may need to be broken into smaller units.
They may need to be broken into
a similar chunks called fragments
in order to Traverse through
different networks with different maximum transmission
unit sizes.
With the different MTU sizes, each fragment
contains a portion of
the original packet along with additional information such
as source and destination IP addresses the
dtl values and the argument
offset values and if
the IP fragmentation happens while the
request package is sent it
causes delays in reassembling the
original packet because the original packet is
split into multiple smaller packets
and each fragment must
include its own either.
So pet MTU Discovery is
used to determine pet MTO Discovery
is used to determine the smallest MTU
along the pad for a
destination host. It's used to avoid fragmentation
and to improve the efficiency of
data transfer. It's performed. Dynamically
the pet enter you
Discovery process is performed dynamically and
adapts to change in network conditions. So
we will talk about the pattern to Discovery
in more detail on the next lesson. It's generally recommended
to should know this.
At this moment, it's generally recommended to avoid
fragmentation by using a Network that
has a large enough MTU or by using
a protocol that can segment the data
at a higher level such as TCP.
So in here in our sample traffic,
we are thinking of the request it used
as the TCP segments.
And we will also see that the packets are being
sent using TCP segmentation instead
of fragmentation in real example
traffic over Wireshark soon.
So if the request packets come in segments as
different pdus it will be reassembled
on the server side as you
can see in here.
and
We can call the time which is spanned for
sending the request pdus as
in here to the server as request time.
If there is an IP fragmentation together
with segmentation process, we can
predict that the request time will increase
even more.
Because with IP fragmentation the reassembling
process would have increased.
So after the server received the request reassembling
the pdus.
It may need to sometime in order to fetch the
required data that has been requested by the
client of from the moment. The request
packet is received on the
server side to the time the data is sent.
We can call it service time.
That is the time taken for patching.
The data is the service time.
During this time the web server
may be talking to another server. For example a
DB server as you can see in here web
server maybe talking to
an external service during the service time.
So keep in mind that and we are
moving on.
Then at the end of this conversation of fetching
the data.
The server receives the data and it starts
sending this data to the client.
So it will most likely send the data as multiple
pdus as in here, which
are the components of the requested data.
We can name the time which spanned for sending the
response as response time.
And note that the response time is the time takes
to transfer the data from the web server to
the client to the browser.
So and then
we can give a name as a pdu
response time the entire period
starting with sanding the request
until the whole response receiving
by the client.
And it may take a Time depends on
the browser for rendering onto the
page is ready to represent to the user.
At the end the data can be seen or
displayed by the user on its browser.
Well to sum up let's talk about the
turbo shooting base on slow networks looking
at the entire picture here now does
we can put the puzzle pieces together?
And first of all in order to discover the
reason and a source of network latencies, you
need to capture the network traffic at each
point of the topology separately.
But namely you must have the
traces from each point. It means
that you should plug in version to the
client and to the web server and
even to the database server when
it is necessary if you get praise
from only the client.
You can't find the reason of the latency sourcing from
the server. Maybe you can see
only that the latency sourcing from the server.
However, if we have a trace from
the server we can discover whether the
latency is sourcing when it talks
to a database server or any external
service or if there may
be a part where problem.
We can have an idea about it. But at first
glance if we have a high pdu response
time.
Then there is some sort of issue.
We can be sure about.
In order to discover where the issue is.
We should look at the time Parts as
client-time request time
and the response time.
So if we have a high service
time, then we can say that the issue
is sourcing from the vector.
And we should focus on the server side.
In order to solve the trouble
on our Network.
But if we have a high request time by
request sending a duration or high
response sending time, we
can say that the issue is in the
network namely intermediary Network
namely intermediary network
devices such as routers switches or
firewalls and even the cables.
However, if the entire pdu response
time is small but experience Time
by user to get the data is large
then the problem is in the client
side.
And that is in the browser itself.
Of course, maybe they browser is spending too
much time and should be to render the
page or display the data so that
may also cause to increase the response time
experienced by the user.
Now, let's look at a similar traffic in
the version.
in this sample Network traffic PK file we can
observe this firstly with the
packet 48
I will look at this conversation in this
PK file.
There's a request packet with the HTTP get
message.
And after this request server is
sending the response as an
image file because it contains the
request contains an image file as
a request.
And we will investigate this conversation in here.
And with the packet 48 declined
is sending a request to
the web server to the HTTP server,
but not that here. The
request is sent as a single
pack.
So it was sent without segmentation or
the fragmentation then the server
sends an egg message in here informed
that.
It has received the request with this
act message. The web server says hey, I
have received your request. It's okay informed.
Then after the request has been received by
the vector at this point.
Web server may talk to the another server such
as a database server or an external
service for a while in order
to fetch the request data.
and by the way as a feature
of Wireshark
You can you can add a Delta
time.
Adult time column to the packet list Pane
and the Delta time column is a
feature of Wireshark displays the time difference
between sequential packets.
And we can observe the time
between The Pact.
To sum up the Delta time column in
Wireshark displays the time difference
between the sequential packets in
a capture.
And this will be useful to investigate the
traffic by observing the time which takes between
the packets. For example, if the Delta time value is
large between two sequential packet
as in here, maybe.
They may have a large time between these
packets, but this is not so
much time.
between the packets
And if the Delta time value is large between two
special packets, it could indicate that
there is high latency or packet loss
on the network.
It's worth noting that the Delta time column.
Isn't displayed by default in Virtual. You
need to add it to the Wireshark columns and
it's useful for identifying and analyzing
Network performance issues such
as latency or packet loss.
so here
by examining by investigating the Delta
time periods between the request packet and the
response packet.
The response packet is Packet 61
and you can
calculate the time.
spending
for the response
and you can analyze the time
between the request packet and
the response packet using these values
these Delta values.
By investigating the Delta time. I want
emphasize that by examining the Delta
time periods between the request packet and
response packet.
We can find out how much time must spend
to bring the necessary data.
And as you remember we named this period
as service time.
After the required data has been obtained
or prepared at this
point.
The server begins to send the data as
response with the packet if
the two.
And when we see some pdus which
are components or portions of
the image file requested by
the client.
and so in order to see this process in
our traffic, let's look at the packet 502
I will expand the detail.
associated with the TCP protocol
as in here
Let me resize that.
Combine the packet 52 it
starts to send the response packets the
server starts to send the response packets
and these packets are being sent with
only making TC segmentation.
There is no IP fragmentation and
we can see the TCP protocol
as the packet protocol in
here because of that I'm expanding.
the IP field first a
and as you can see in here at some
Flex value, we have some Flex
value.
and when we look at the flag values
we can see the don't fragment the
deity value is set so
don't fragment bit
is set it is set to 1 this means
don't use IP fragmentation sending
this packet.
In most of the real Network traffic we see
that the data is divided into ideal sizes in
the TCP segmentation stage to avoid
IP fragmentation in this way.
And you will see this setting in the other response
packets as well.
When you look at the other response packets,
for example the next packet.
You can see the don't fragment pit
is set.
as well and the
next packet
next video
also is set to the
one.
And we can see the same in the
other packets in the other videos, but now
turn back to the first edu associated with
the requested data.
And you will see this setting all the
other response packets as well if there would
be a IP fragmentation.
You would have seen that the bits of the more fragments and
fragment offset parameter
values change. So there
is only TCP segmentation sanding response
to the client furthermore when you
look at the TCP field.
Let me show you.
And scrolling down.
You can see another expression in the TCP field.
You can see another expression representing that
this video is the part of a packet
and it says with this expiration
a this packet this pdu or
this pdu is resembled in
playing 61.
So this video is reassembled in
the packet 61.
Okay, you can look at the packet.
Because the pdus are reassembled in
the packet 61 we can
understand that this packet.
Is our real original data packet?
And it contains some reassembled pdus.
within itself
and
you can look at the packet 61 in order to
see the reassembled version as a packet.
So furthermore when we click on packet
60 one.
As an advantage of using partial we
can see the components of this.
the reassembled components in here
and you can also see the components of
this reassembled packet.
In the packet list pane as small gray
points, you can see the components each
component of this reassembled packet.
When you click on this packet, you
can see the reassembled packets
one by one as
small gray points as you
can see.
The reassembled packets the components
of the actual data.
Are being represented with degree
points as you can see
in here.
by the Wireshark
and as a Wireshark feature
so
and this great points are being
used to point out that
the packet 52 and the 53
and the if the six and
58 and 59 are
the components of the packet 61
we can understand that.
So and of course, you can see the reassembling
process when you expand the
details in the packet.
61 as in here under the
TCP field.
So look at this it says.
There are six packets have been reassembled and
they consist of the image file
which you can see under the TCP field.
as JPEG file interchange format
So with this packets we have
seen that the pdus have been sent to the
client by the server as in
here.
In this way, we have seen an example traffic
use a TCP segmentation instead of
Ip fragmentation.
Now let's focus on and investigate the IP
fragmentation process over the OSI model.
As you know IP fragmentation arises at the
network layer of the OSI model specifically at
the IP protocol.
And when a packet is generated by an application.
It is passed down to the transport layer firstly
where it is segmented if
necessary.
And the segments are then passed down to the
network layer where the IP protocol at its own header. The
resulting packet called an IP
packet is then passed down
to the data link layer and where
it is encapsulated in a
frame as you know in a frame and transmitted
over the network. When an
IP a packet is sent over a
network if the size of the IP datagram
exceeds the maximum transmission
unit exits. The
MTU value of the network is divided
into smaller chance called as
fragments or not that the NTU
is the largest packet size that
the network. I can't transmit without
fragmentation on the other hand IP fragmentation
is the process of breaking down a
large IP packet into smaller packets.
Can be transmitted over a Network that has a
smaller maximum packet size. This is
necessary when the packet size exceeds the
maximum transmission unit
of the network.
But when a large packet is encountered the
fragmentation processes initiated by
the standard typically at the
network layer the sander breaks the large packet
into smaller chunks smaller packets called
fragments and a size a
unique identification number to each fragment.
So the sender also includes information in each fragments either
that indicates the total number of
fragments the fragment of set and the
original packets identification number.
So the fragments are then transmitted over the network
and reassembled by the receiver. The
receiver uses the information in the fragment
heaters to reassemble the original Act.
Now, let's investigate a sample Network
traffic used IP fragmentation.
In order to observe the IP fragmentation process
in a real Network topic. I
have created a network traffic before in a
lab environment.
I will show you in the next lesson how I created
the traffic in order to describe the pet
MTU Discovery process. Let's investigate only
the traffic packets to understand
IP fragmentation of and look
at this fragmented pack.
the packet 13
and let me show you the IP details IP
field details in here.
And resizing the back details
window.
So when we look at the black values in this
topic, as you know, we have
seen that the DF don't fragment
flag value this black
value bit is set to one in
the previous traffic that we have
investigate before the previous pickup file
the HTTP traffic pick a file where
the packet size is a adjusted by performing TCP
segmentation in that traffic. We
have seen the F value is set
to one but in this traffic
We are seeing the DF value isn't set
and its value is zero.
so
because it isn't desirable to split the
packets into fragments using IP fragmentation.
In the previous pickup file. We have seen the
DF value as one in order
to avoid the IP fragmentation to
prevent the fragmentation process. It
is preferred to adjust the packet length using
TCP segmentation in order
to have a good performance the good
Network performance and security, but now you
see the dfp is not set in here.
And its value is zero.
But it means this packet can
be fragmented and we look at
the more fragments value.
It is said.
And its value is 1 so.
The MF leg the more fragments like
is used as part of the IP
fragmentation process.
The more fragments of black is a
bit in the heater an IP packet
that is used to indicate whether effect is a fragment
of a larger packet or the only packet
being set.
If the MF black if the more fragments select
is set to 1 as in
here.
It indicates that there are more fragments of
the original packet to come.
If the MF flag is set to 0 it indicates
that this is the last fragment of the packet.
So here more fragments is set to 1 note
that and then this
is a fragment of a larger packet.
And this is a component of a larger packet.
So the fragment offset value the next
value you can see the fragment
offset is a value that indicates
the position of a fragment
relative to the beginning of the
original pack.
and this information is
pregnant offset information is used by the
receiver to reassemble the fragments in
the correct order.
But it is used by the receiver reassemble
the fragments in the correct order. Keep
in mind that associated with the pregnant
offset information the destination
host reassembles the fragments
by using the information in
the fragment heaters. So the fragments
are reassembled in order based on
the fragment offset value and original
packets identification number
packet ID.
is in here
but here the fragment offset value
is zero.
And it means the beginning part of this packet is
zero.
and scrolling on
so also you can see the expression
which says this in
here you can see this expression in
here.
This expression which says this packet fragment is reassembled
by IP version 4
in according next
spec. It means the next pack.
So this fragment is reassembled
by people in the
next pack in the packet 14.
And there is another either parameter
Maybe.
you can recognize it and
In here, there is another either parameter the
either check some perimeter. We
have the heater checksum field contains the
take some value but it is used by
the destination to check for the Integrity of
the transmitted data. The size of this
field is 16 bits.
as you can see the
in the packet bytes
pane when you click on the heater checksum,
then you will see its value corresponds to
the 16 bits.
Okay, the heater check some value is calculated by
the standard and it sent
along with the IP header.
When the datagram reaches the destination the
checksum is calculated by the destination by
using the same method with the source or the
sender if the value that
is calculated isn't equal to the specified either
check some value in the header of datagram the IP
datagram the packet is
discarded. So the either check
some value is calculated only with
the heater values and not by
using the data. It's a
So every intermediary device that receives
the data must calculate the
header checksum value before forwarding.
Keep in mind and when we look at the next packet.
the reassembled packet the original
data
We will see some details in here now in
this packet in the
packet 14 now we
can see the icmp field.
Because the fragments are reassembled in
this packet, so this packet is an icmp pack.
Now look at the IP Fields firstly.
In the previous packet fragment offset value was
Zero.
as you can see
the fragment offset value was 0 but now
we have seen.
a different value for the fragment offset value
as you can see in the packet 14 fragment
offset is now 1480. It
means that this package starts with
this white value with this part
A 1480 and
this packet starts with by 1400 80
so as a result first fragment includes the
first fragment a packet 13
includes bites between 0 and 1479 and
second fragment as the
packet 14 includes bytes
between
1400 and 180 and
the remaining
it consists of bytes between despite
and the remaining part if we
look at the IP version fragments build.
In here IP version fragments field and
their total size.
You can see 1500 and
8.
Oh here it says we have two
IP version 4 fragments and
their total size is 1508.
So first one has a payload.
First fragment as a payload with the
1480 bytes.
And it is located frame frame packet
frame packet 13 is located in the
packet 13 and it has the byte
between 0 and the 1479.
And second one is in frame 14
and in
this brain.
It means that in this Frame, so it
has the bytes between 1480 and
1507.
And totally 28 bytes.
So it has a payload is a
payload with 28 bytes.
Since it starts from by the formbyte 1400
80 it's fragment
offset value is 1480.
Not that it starts from
bite for 1480. It's
fragment offset value is
1480.
You can see here.
And it says that the fragments are reassembled
in here in this
packet.
So when you look at the icmp field.
You can see another information associated with
the data.
and
you can see this is a pink request Act.
This is the ink request. You can see under
the icmp field.
Okay to sum up if it needs
to talk about transmission of the fragments in
the network. We can say those things. However fragments
can be lost in
transit and the reassembling process
May Fail if any of
the fragments are missing.
So okay to sum up if it
needs to talk about the transmission of the
fragments in a network we can say those things.
Fragments can be lost in transit and the
reassembling process May Fail if any of
the fragments are missing.
Also since fragments are
transmitted separately they may you know
out of order.
And you can see some Auto folder packets in your
network in your network traffic file therefore.
The reassembling process must handle missing
or out of order unordered fragments
fragmentation can also cause a
significant increase in overhead.
And reduce the efficiency of an Network.
And for this reason it's generally desirable to
avoid fragmentation by using a Network that
has a large enough empty you or by
using a protocol that can segment the data
at a higher level such as ECP.
So now let's emphasize that
once again IP fragmentation can cause
a significant increase in
overhead as the original packet is
simply into multiple smaller chunks and
each fragment must include its
own hidden information additionally fragmentation
can lead the performance issues
as fragments may be lost
in transit or AI autofolder causing
delays in reassembling the original packet.
Another important aspect of Ip fragmentation
is the handling of fragments at
the network devices like routers when a
router receives air fragment, it must
decide whether to forward the fragment
or drop it.
The router uses the information in the fragment header
to make this decision.
If the router determines that the fragment
is the first fragment it will forward it
to the next.
But if the rotor receives a non-first fragment,
it will check its fragment buffer to
see if it has already received the first fragment.
If the first fragment is present in the buffer the router
will forward the non-first fragment.
If not, the rotor will drop the non-first
fragment.
And it is worth noting that IP fragmentation
can also be exploited in various
types of attacks.
Such as fragmentation attacks, which
can be used to evade network security devices
or cause a denial of service those
back and therefore net Network
administrators should be aware of
the financial risks and take appropriate measures
to mitigate.
and in summary
IP fragmentation is a process used to
break down large IP packets into
smaller packets that can be transmitted over a Network that
has a smaller MTU.
the fragmentation process is
at the fragments are reassembled by
the receiver.
However, fragmentation can cause a significant
increase in overhead lead
to Performance issues and be
exploited in various types of attacks. Therefore,
it's generally recommend to avoid fragmentation
to avoid IP fragmentation by using
a network.
There's a enough MTU or by using
a protocol that can segment the
data at a higher level such as DCP.
So that's all for now. See you on the
next video.