So I was playing with some captures of fragmented packets. My interest was in observing the offset values, and the more fragments bit. I was sending ICMP messages with a size of 2544.
This will obviously be fragmented because it is bigger than my default MTU. When I took a look at the capture this is what I saw.
Where are my fragments?????
Oh there they are. For some reason they are classified at IPv4 instead of ICMP…how very annoying. If anyone knows why let me know.