Are there any sources where I can find different pcaps samples for IP fragmented data (WireShark compatible)?
Asked
Active
Viewed 8,842 times
2 Answers
5
See the files attached to the following Wireshark bug reports for examples of IP fragmentation.
I would note that IP fragmentation is IP fragmentation regardless of the payloads carried over IP;
What are you looking for that you wish to see "IP fragmentation of FTP data, images, files, etc" ?
Is it actually TCP re-assembly that you wish to look at ?
willyo
- 961
- 7
- 9
2
Take a look at the Wireshark Sample Captures wiki and search for fragments... for instance, they have the Teardrop overlapping IP fragment attack
Sending that to PCs would lock up an unpatched Windows 95 machine...
EDIT
If you want to see general IP fragmentation, I can't think of a capture offhand, but you can simulate IP fragmentation with creative use of tcprewrite under *nix.
Mike Pennington
- 41,899
- 19
- 136
- 174
-
@Mike, thanks. I already looked at that one but I wonder if there are more comprehensive samples somwhere – May 01 '11 at 11:01
-
@Wajih, when you say comprehensive, what additional data points are you looking for? – Mike Pennington May 01 '11 at 11:03
-
@Mike, like IP fragmentation of FTP data, images, files etc. Which are then reconstructed by WireShark. – May 01 '11 at 11:05
-
@Wajih, do you have access to a linux machine? – Mike Pennington May 01 '11 at 11:15
-
@Mike, Ubuntu is the best I got – May 01 '11 at 11:16
-
@Wajih, nothing wrong with Ubuntu... check out my edit. If you're willing to rewrite a pcap, then `tcprewrite` will allow you to see what normal IP fragmentation looks like. Just feed it any FTP transfer and it will fragment at whatever IP mtu you specify. – Mike Pennington May 01 '11 at 11:20
-
@Wajih, sure thing... I use debian, so it is the `tcpreplay` package... I'm not sure what Ubuntu does, but usually they have the same package names... – Mike Pennington May 01 '11 at 11:23