Ethereal-users: Re: [Ethereal-users] ethereal not capturing oversized Ping packet with Don't Fra

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Hansang Bae <hbae@xxxxxxxxxx>
Date: Wed, 08 Feb 2006 22:52:30 -0500
On 12:34 PM 2/8/2006, Daniel Wang wrote:
>I am run 0.10.14. I was trying to see if I could figure out which router has the smallest MTU. My environment is Vlan enabled Cisco mulitilayer switching with windows xp sp2. Here are my command lines:

[snip: Windows ping packet size 1281 doesn't work, 1280 works.

> 
>When I turned on ethereal, it only captured the successful ICMP echo request/reply packets. There was no trace of the attempt using the oversize packets. Why is that? Obviously the router generated the error because it couldn’t fragment the packets. Can someone shed some light on this? 
> 
>I am using Realtek RTL8139/810x FE NIC.



You need to look at icmp type 3 code 4 messages coming from the router.  So if you look closely inside the ICMP 3/4 messages, it will tell you what the MTU should be set to (and who generated the message)

hsb