Wireshark-users: [Wireshark-users] the Fragment offset field in IP packet should follow the Raw b

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: damker <damker@xxxxxxxx>
Date: Fri, 19 Jun 2020 15:48:41 +0800
an IP packet decode As follows:
    ...
    Flags: 0x006b
        0... .... .... .... = Reserved bit: Not set
        .0.. .... .... .... = Don't fragment: Not set
        ..0. .... .... .... = More fragments: Not set
    ...0 0011 0101 1000 = Fragment offset: 856
    Time to live: 128

I know that it says "The fragment offset is measured in units of 8 octets (64 bits)" in RFC 791.
my question is: Flags = 0x006b, the "...0 0011 0101 1000 = Fragment offset: 856" should be "...0 0000 0110 1011 = Fragment offset: 856"?
I think the second one is more clear.



damker