["Felton, Doug" <Doug.Felton@xxxxxxxxx>]

Title: Message

Ping is an ICMP packet, as are the DF notifications from the router.

 

-----Original Message-----
From: ethereal-users-bounces@xxxxxxxxxxxx [mailto:ethereal-users-bounces@xxxxxxxxxxxx] On Behalf Of Daniel Wang
Sent: Wednesday, February 08, 2006 12:35 PM
To: ethereal-users@xxxxxxxxxxxx
Subject: [Ethereal-users] ethereal not capturing oversized Ping packet withDon't Fragment bit

I am run 0.10.14. I was trying to see if I could figure out which router has the smallest MTU. My environment is Vlan enabled Cisco mulitilayer switching with windows xp sp2. Here are my command lines:

 

C:\ ping webwall -l 1273 -f

 

Pinging webwall.xxxx.com [172.16.2.103] with 1273 bytes of data:

 

Packet needs to be fragmented but DF set.

Packet needs to be fragmented but DF set.

Packet needs to be fragmented but DF set.

Packet needs to be fragmented but DF set.

 

Ping statistics for 172.16.2.103:

    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

 

C:\ >ping webwall -l 1272 -f

 

Pinging webwall.xxxx.com [172.16.2.103] with 1272 bytes of data:

 

Reply from 172.16.2.103: bytes=1272 time=1ms TTL=127

Reply from 172.16.2.103: bytes=1272 time=1ms TTL=127

Reply from 172.16.2.103: bytes=1272 time=1ms TTL=127

Reply from 172.16.2.103: bytes=1272 time=1ms TTL=127

 

When I turned on ethereal, it only captured the successful ICMP echo request/reply packets. There was no trace of the attempt using the oversize packets. Why is that? Obviously the router generated the error because it couldn’t fragment the packets. Can someone shed some light on this?

 

I am using Realtek RTL8139/810x FE NIC.

 

Thanks,

 

Daniel