Hello everyone in this lesson. I will tell you about the
pet MTU discovery.
Firstly I want to tell you the MSS and MTU
Concepts.
Here we see an ordinary frame structure as
you can see a frame as some
heaters as tcp/ip and ethernet in
addition to payload which contains actual data
as you know, when an application data is
payload goes over the network layers
from top to down in every layer a
heater is added to the payload. Let's briefly
recall. The journey story payload is generated
in the application layer. There is no iterated
time of production is alone. Then as
the application layer starts go down
either start to be edit and TCP
heater is added in transport layer
and it goes down
to the network layer. Then at the
network layer and IP heater is added by
the IP protocol.
So and it goes down to the data
link layer in the data link layer, the
internet either is added
last.
And with the addition of this ethernet header,
it becomes a frame.
So that's why the structure we see here is now called a
frame finally. You already know
that it turns into bits at
the physical layer.
Now, let's discover the MSS over this structure.
MSS or maximum segment size is
a parameter used in transmission control protocol or
use it in TCP to specify the
maximum size of a data segment
that can be sent in a single packet and
it is the maximum amount of data
that can be carried in a single TCP segment.
So MSS is used by both
the Thunder and the receiver to determine the
maximum size of a packet
that can be sand without fragmentation.
And the MSS is usually defined as
the maximum size of a packet that
can be sent over a particular the network.
It's calculated by subtracting the
size of the IP and TCP heaters
setting the MSS too high
and result in fragmentation can reduce
speed due to the additional overhead
of the assembling the packets at the
destination. So it can also increase
the risk of packets being dropped and
setting the MSS too low
can also decrease performance as it limits
the amount of data that can be sent
in a single packet leading to
increase overhead and increased number
of packets. So a standard and
specify the MSS the MSS of a
connection by including the MSS option in
the TCP sync packet during the connection set.
So the receiver can also specify the MSS
by including the MSS option in
the TCP scene aspected and the
smaller of these two values is used as
the MSS or the connection.
Setting the MSS too high can cause fragmentation.
so
now let's look at the MTU structure
in here and the
maximum transmission unit. As you know,
MTU means maximum transmission
unit. And MTU is the
largest size of a packet that can be transmitted
over a network without fragmentation. It is
a network layer perimeter that
is used to specify the maximum size
of a packet and sand or particular Network
in some cases routers may
also perform fragmentation themselves if the MTU
of next up next up Network
smaller than the MTU of
the current Network and this is
known as at and you discover
so
how we calculate the payload size and buy
MTU size or the structure?
Let's suppose that the MDU size of a network is 1500
bytes.
The size of the IP header can change
a but a common sizes 20 bytes
for IP version or and party
bytes for IP version 6
and the size of the TCP heater
can also change but common size of
the ECP heater is 20 bytes
as well. So for this example,
let's assume that we are using IP
version 4 and the size of
the IP heater is 20 bytes and the size of the TCP heater
is again to antibiotes.
So to calculate the MTU size
we subtract the sizes of
IP.
And we subtract the TCP headers from
the mpu size or as well.
Now as you can see, we have subtracted the
IP header size and it
isip size from the MTU size
and the result is 1460
as payload
data size.
So in this example the maximum size
of the data payload in a packet is 1460 bytes
and any packet with a data payload
larger than this size.
Larger than 1,460 bytes would
need to be fragmented or transmission over
this this network and it is important to
note that this is just an example and
actual MTU size and either
sizes can change depends on which Protocols
are being used in this
traffic. So for example, if icmp
protocol heater is used instead of
the TCP protocol TCP
leader, it will occupy eight bytes
not 20 bytes for this
part and the payload amount will
also change accordingly in
case the empty size 1500 bytes.
We see the total packet size as
1514 since
an internet either will
be added to the packet and when we add
the internet either size to the
MTU size will be 1500 and
14 bytes as
a packet size. So the result
will be 1500 14
bytes. Okay. Now there
will be some addition bites in total
packet size and 14 more bites
are added for the internet either
and keep in mind that these 14 bites
are not included event calculating
the empty you size
Because the Internet heater isn't included
in the empty you
and now let's move on.
Okay. Now we will observe how to
apply the IP fragmentation. Also, we
will see the pet empty Discovery and
how to find the maximum payload size
to do this. We are gonna send some icmp
pink packets with different packs with
different packet lengths different
packet size to a Target
machine and it means that we
will change the pink packets. We will
change the sorry. It means
that we will change the pink package lengths
step by step one by one and we
will increase and decrease the
size of the pink packets in
order to see the maximum payload size.
Here we have a topology like as
you see I have a Windows machine on
the left side and I have a column
machine on the other side. So in this lab environment,
I have done the process include sending
pink packets in different lengths to the
Target. I have captured the traffic during
these steps. So let's take
a look at these pink steps and network packets
in Russia.
Now in here we will send pink packets
from the Windows machine to the Target before
doing this. We are learning the
MTU value of our interface and
you can see
the interface information by this amount
of you can open the windows Powershell and
type this netsh command. And
when you click on the enter after typing
the command will bring interfaces that
we have and you
can see the ethernet interface that
I am using actively and it's empty
size is 1500 bytes
as usual.
So now we have the information about MTU length
in here. We have
the MTU size as 1500 bytes.
Let's start sending pink packets now.
Firstly I sent a standard pink packet in
here as you can see and it has
32 bytes packets.
Let's see these packets in Wireshark now.
in here as you can see, so here
is decent or pink pink
request packets and
We will be receiving four pink five
packets as response. And
for this reason first eight
packets belong to this pink.
conversation
so we send pink packets which has
32 bytes data.
As you can see in here.
But we see their length in Wireshark
as 74 bytes why
let's look at the first packet
details in order to understand this difference.
So
I'm expanding the isi icmp protocol
field in here and we can
see the data built in the details.
So look, our data size is again 32
bytes as it should be. So this
means the payload part is 32
bytes, but when you
click on the icmp field
You see that the total size of the icmp
field is 40 bytes. Yes,
because total icmp header size
is 8 bytes. We should know that
an icmp packet consists of the payload and
the heater.
I mean the icmp components
are as the header and the payload
part and Hider part is
8 bytes. The heater part.
The size is 8 bytes. And the
payload part is 32 bytes as
in here.
So the icmp field is portabytes in
total.
now move on to calculate
Let me click on the IP field
as you can see in here.
When you click on the IP field you can see this part
has 20 bytes or IP.
So and we already have party bytes or
icmp now adding this 20 bytes
for IP. The result will be 60 bytes.
So okay with the IP field we have
60 bytes now.
and when we click on the ethernet field
We see that the internet either size is
14 bytes. So this was the
last either part and with the internet
60 bytes plus 14 bytes
is equal to 70 or
bytes. So in this way total packet
size is 74 bytes.
And now let's change the pink data
size to different value.
We will change the payload size from 32
to different value.
In order to arrange the payload data
size. We used even LC
which means length and
I have set the payload size as
1500 bytes this
time.
So, you know MTU was the
size of the part excluding the ethernet heater
and with 1500
bytes for payload.
MTU part is now larger than the size. It
should as it should be for the
MTU value has been exceeded.
By this payload value and in
this case IP fragmentation takes place
when we are sending the pink
packets and the pink packet
is a split into fragments will
be split into fragments and then
we'll look at these fragments in Wireshark.
As you can see in here.
it starts from the packet 13 and
we see that each pink packet will
be split into the two fragment and
click on the first fragment now.
on the packet 13
you see why shark is pointing the second
component with a gray
point.
As usual so when you look at the details for the
first fragment.
First fragment has 148 bytes
for the payload data.
And you see that in the IP version
or field it says
this fragment has been reassembled in
packet 14, which is our
next pack.
in the packet 14
So this first fragment has
a 1480 bytes data.
as you can see in here and the second one has
28 bytes
so second fragment is 28 Parts
because it consists of the payload and icmp header.
So payload Parts size is 20 bytes
and icmp either part is 8
bytes in total we have
actually
as you can see in here.
We have actually 1500 bytes per
payload since two fragments
are reassembled in this packet VC old
data in here.
BC first frame a payload
data and we see
the second fragment payload data.
and
we see also the icmp either
data in addition
to the payload data with the 8
bytes and let's look at
the new pink packet.
And let's resize the payload data
again.
We will be will resize the payload data again.
So this time I have set the payload a
payload size to 1480 bytes.
When I click on the packet associated
with this painting command. We
will see the details.
I mean here with this packet,
it starts the new pink packets.
and when I click on the packet to 99
I see that the
First fragment data size is 14 180
bytes and it is
reassembled the impacted 30.
But when you look at the Epic 30,
you will see the reassembled version
of the pink egg.
and
click on the packet party now.
Let's look at here.
I see two IP version fragments again.
First one has payload with
the 1480 bytes
and second one.
As the payload with 8 bytes only 8 bytes
as you get this part contains
icmp either payload by sampy
heater part with this 8 bytes and
it means that if I would have
arranged the payload size as 1472 instead
of 1480. It
wouldn't need to fragmentation. So it
could send Pink as a single pack because
this eight parts part is
Surplus.
Let's arrange the payload size as
1472 bytes.
So in here we send the pink packets
with with the payload size 1472
and
With this payload, we have sent some pink
packets here. And now let's look
at these packets in Wireshark.
You can see in here for sending this
packets. This pink packets. There is
no need for IP fragmentation. And there
is no any IP fragment any
IP fragments in here. Each packets
is is a single
pink equal pink
pack each one each one of them as a
single pack packet as you can see, there is
no IP fragments.
Each one of them is single request
or reply a
pink pack.
There are no fragments and as you
can see the pink packets are being sent as single
packets again because in
here when we subtract the
ethernet header size, which is 14 bites.
We have we have a 1500
bytes as data as payload
data and it is equal to MTU size.
So for this reason, there is
no need for fragmentation or IP fragmentation,
even if the increase the payload size
adding only one byte.
To this payload size again. We
need IP fragmentation. It means
that.
Now, let's look at this.
the next pink packet payload
Okay, let's we have increased the
data payload by only a
one bite and we have changed the payload
size from 1470 to
to the payload size
1473. So
we have added only one byte
to the payload size.
And in this situation when we
look at the package associated
with this pink command.
The click on the packet the
packet 57 we
have seen the fragments in
here for this pink packets.
and
look at this first fragment details.
the packet the 57
So this fragment is first fragment has the
payload sides as 1480 bytes
and on the next packet.
We have seen the other the another
fragment payload size
in here as one byte.
And the extra one byte is sent as
the second fragment as you can see.
The extra one byte is sent as
the second fragment. So we
have needed the IP fragmentation for only this
extra one byte. Okay. Now let's look
at what happens when we try to send the
packets, which is larger than MTU without fragmentation.
To do this, you know, we should set the don't fragment
speed and in order to set the don't
fragment speed to one to
one value as value.
We have set the
don't fragment speed to one we
add in order to in order
to in order to set the don't
fragment speed be at the heapon FC
which into pink command as like
here.
You can see.
So and but this time.
But this time when we
try to Scientific packets by this
pink command, we are receiving returns as
packets needs to be fragmented to
be fragmented. But if said
so we couldn't have sent the package without
fragmentation.
Because the packet size exceeded the
MTU value to sum up
we can call this packet tuning process as as
the path MTU Discovery and
you can also perform such a pink traffic to understand
the pet M2 Discovery process.
in addition to this
You can look for icmp warning message
as fragmentation needed and they
have set the messages and observe the
next up and you field in
the packet details in your traffic. So you
can see such as
this type this type
of warning messages in your icmp
traffic and now let's discuss
the most important points once
more.
In a real traffic over the Internet imagine a
network environment which includes some intermediary devices
such as rotors firewalls van
impact is transmitted.
The sender sets the
packets don't fragment the fit in the IP
header.
So and our pivot will have a
TCP heater.
And TCP level segment data in
suitable size.
So and our payload will have a
TCP heater.
TCP will segment the data in suitable sizes.
And the DF bit indicates that
the packet shouldn't be fragmented that a
vanity packet reaches Arrow a router
that has a smaller ampere than the packet size
the routers hands and icmp message as fragmentation
needed and the set message
back to the sender.
Or this message also will contain the MTU
of the next up in the network.
and
so the path MTU Discovery
process will perform dynamically by these
devices such as routers.
But to do this, first of all, the router has
to be kept has to be capable of doing this
process, then it can return back the
empty value of the next hop to the
packet sander as well.
And so secondly, this MTU
value is empty your value
feedback message sent by the router is an
icmp.
Message so in here therefore the
endpoint device must also
allow icmp messages in order to be able
to receive this feedback from the router.
And because if there is an entire military device such as
by by such as firewalls, which
prevents icmp messages
and the end point cannot receive
the feedback.
So and in case of cannot receive
this feedback about MTU by
endpoint, it cannot reduce or arrange
the packet size.
So if there is if there is no prevention by
some devices such as firewalls descender
turned down reduce the size
of its packets to avoid fragmentation by
using its smallest MTU along the
pad.
And note that today the pet
M2 Discovery is available as default
in in almost all most modern
tcp/ip implementations and
it is required that your five
firewalls or packet filtering devices. Don't prevent
the icmp pattern you
discover messages and sending host sets.
They don't fragment the FP
in the IP theater.
The packet is too large to be a transmitted toward
the network without fragmentation. It will
be dropped by a network device along the
path. The network device will send back
and and icmp message.
Indicating that the packet was dropped to
due to due to fragmentation and
that is smaller packet size is required.
The sanding cost receives the icmp
message and reduces the
size of its packets to the
suggested size.
And the sanding host continues
to use the new MTU for
feature Transmissions or that Network at
if the network path changed the
pad and to you the pad
MTU Discovery process will be repeated.
For example, if a network link with
a lower MTU is added to the
pad the sander will receive a new
icmp message indicating the new lower
MTU or the new
MTU value and it will
adjust its packet size accordingly.
Top add M2 Discovery can be used
to increase the network performance and cpeed
by allowing access to be transmitted
at the maximum possible size without fragmentation.
When packets are fragmented.
They must be reassembled at destination which
can cause delays and increased overhead
by using pattern you
Discovery the standard can determine the
smallest mpu along the
path to the destination and sand packets that are
small enough to avoid fragmentation. This
can result in Faster data
transfer and lower overhead.
It's worth noting that had empty Discovery
could be affected by some network devices that
block icmp error messages. This could
cause packets to be dropped instead of being fragmented.
This could lead to connectivity problems
in your net.
Also pet and you Discovery isn't a standard
protocol some network
devices may not support it in your
over your network at or in
your network environment.
Now let's talk in more detail about the benefits of
avoiding IP fragmentation with
that M2 discovery.
So now we will talk about the advantages of
the pet M2 discovery.
And the first one is improved efficiency.
A by sounding packets that are small
enough to avoid fragmentation. You can improve the
efficiency of data transfer this is
because the packets will not need to be reassembled a
destination which can save time and reduce
delays.
So the second one is reduced
overhead and band pickets are
fragmented. They must include additional hidden
information such as additional IP
heater and which increases
the size of the packet and increases
overhead by avoiding fragmentation.
You can reduce the overhead overhead
and improve the overall performance of
the network.
But the third one is better reliability and
when packets are fragmented, they
can be lost in transit it can cause
the reassembling process to fail by avoiding
fragmentation. You can improve the
reliability of the network and ensure
that a data is transmitted correctly and
the other advantage of the ATM to
you Discovery is better security fragmentation can
be exploited in various types
of attacks such as
fragmentation attacks, which can be used to evade network
security devices or call the
denial of service those attack by
avoiding fragmentation. You can reduce
the risk of these types of attacks.
And the other one is better quality of service pet empty
Discovery can help ensure that important traffic
such as real-time voice and video can
be transmitted at the highest possible quality
by avoiding fragmentation.
So it's worth noting that pet M2 Discovery
works best when it is able to dynamically adjust
the packet size to the smallest mu along
the pad.
So it is also important to keep in mind that there
could be other factors that could affect the
network performance such as Network congestion and
it will be best to
monitor the network performance regularly and
troubleshoot any issues that may arise.
Now I want to talk about how to determine the
causes of slow Network in summary.
So here are some ways for detecting causes
in slow networks. And first one
is monitor the network performance. You
can use a network monitoring tools
such as Wireshark capture and analyze Network
traffic and you can look for patterns and
anomalies that may indicate problems such
as I packed those High latency or
low throughput
And the second one is checking at MTU
Discovery. You can use Wireshark
to observe the icmp fragmentation
needed and we have set messages and look
for you can look for the next up MTU
field in the packet details and
you can compare the next hub MTU
value with the packet size in order
to see if packets are being fragmented if packets
are being fragmented then the cause
of slow Network could be that the packets
are being sent at a larger size than the
maximum transmission unit size of the network.
At the third one is checking for Network congestion. And
if the network is congested then
packets may be dropped or delayed
which can cause slow Network performance.
So the other way is checking for quality of
service issues can use network monitoring tools
again, in order to check or quality of
service issues. For example, if the network
is arranged for the quality of
service, but the turf is not being prioritized correctly and
then it could cause slow Network
performance for some types of traffic. This
was one of the most common definitions I
encountered in the companies. I provided Support Services to
So there were some problems mostly interruptions
and quality problems in Voiceover IP terrific
because the quality of service process in
the network traffic wasn't done correctly or at
all, and the traffic wasn't a prioritized
correctly.
So and the other way is checking for network
security issues such as denial of
service attacks or other types of malicious traffic.
This could be the cause of slow Network
performance as well. As you know, and the
sixth one is checking for Hardware
or software issues.
You can check for Hardware or software issues such
as outdated drivers or malfunctioning network
interfaces or incorrect a
network configurations. These issues can
cause a slow Network performance as well.
And usual check for other issues that could
affect Network performance. So there are
a variety of other issues that could effect in its
work performance such as Network topology writing and
network capacity.
It's important to consider all possible vectors
when troubleshting solar Network performance process.
It's worth noting that finding the
root cause of network issues can be complex and
time-consuming. It's important to have a
good understanding of network protocols tools and
to be prepared to use a
combination of different techniques to troubleshoot the
problem.
To sum up head empty Discovery is a
mechanism used by IP to determine the
maximum transmission unit to determine
the MTU along the pad to a
destination host. It starts by sending a
packets with the don't fragment bitset in
the IP heater. And when a
packet reads a router that is a
smaller amp to you than the packet size the router sends
and icmp message which contains the
warning fragmentation needed and PF set.
To the sender the sander can then reduce the
size of its packets to avoid fragmentation by
using the smallest MTU along the
pad.
And its performed dynamically and fit to
change in network conditions. It
allows the sender to discover the smallest MTU
along the pad to destination host
and adjust the packet size
accordingly.
So that's all about the pattern you Discovery.
See you on the next video.