Introduction

The first packet in a fragment series shows the size into which the original packet was fragmented -- the MTU of the link following the machine that performed the fragmentation. Some of the MTUs are clearly the MTU of the subsequent link (e.g. 1500 bytes) and others are common settings to improve network performance (572 bytes for PPP), others are clearly evidence of misconfigured machines (e.g. 44 bytes -- 40 bytes of header overhead and only 4 bytes of data transferred!).

Analysis

The link we monitor at the Ames Internet Exchange is load-balanced -- our monitor captures only a fraction of the traffic through AIX. Since individual packets can be routed through any of the links at AIX, and not necessarily the link our monitor can "see", we see far fewer complete fragment series. 93.0 percent of the fragments monitored on the UCSD-CERF link are members of a complete series, compared to between 9.6 and 10.8 percent of the fragments at AIX. The effect of load balancing drastically reduces the number of complete series, removing much of the random, background MTU sizes and leaving behind the more highly prevalent sizes. There are no first fragments larger than 1500 bytes, since all the links we monitor have an MTU of 1500 bytes.

frag_cerf_2000-05-17_12-11

This trace was taken on the UCSD-CERF link from Wed May 17 14:40:39 PDT 2000 to Fri Jun 2 20:42:48 PDT 2000. 50,375,114 packets containing 50,945,519,628 bytes of data composing 19,054,937 fragment series were captured in this interval. Of those, 17,718,285 (93.0%) were complete series.

aix_frag_958848611

This trace was taken from the Ames Internet Exchange from Sat May 20 11:50:42 PDT 2000 to Tue May 23 23:04:01 PDT 2000. 9,781,240 packets containing 11,406,413,861 bytes of data composing 7,183,794 series fragment series were captured in this interval. Of those, 692,184 (9.6%) were complete series.

aix_frag_959148226

This trace was taken from the Ames Internet Exchange from Tue May 23 23:04:17 PDT 2000 to Fri May 26 11:00:28 PDT 2000. 8,599,458 packets containing 9,327,540,025 bytes of data composing 6,922,673 fragment series were captured in this interval. Of those, 747,401 (10.7%) were complete series.

aix_frag_959364017

This trace was taken from the Ames Internet Exchange from Fri May 26 11:00:48 PDT 2000 to Wed May 31 00:27:38 PDT 2000. 12,273,208 packets containing 13,645,419,937 bytes of data composing 9,832,899 fragment series were captured in this interval. Of those, 1,069,074 (10.8%) were complete series.