Introduction

Packet fragmentation occurs when a packet too large for the subsequent link reaches a network interface and is broken up into a series of fragments the size of the MTU of the ensuing link. Packet fragmentation has a negative impact on network performance for several reasons. First, a router has to perform the fragmentation - an expensive operation. Second, all the routers in the path between the router performing the fragmentation and the destination have to carry additional packets with the requisite additional headers.

About This Trace

The data in the following section comes from a trace which contained only fragmented traffic. The trace was taken on the UCSD-CERF link from Wed May 17 14:40:39 PDT 2000 to Fri Jun 2 20:42:48 PDT 2000. 50,375,114 packets containing 50,945,519,628 bytes of data composing 17,718,285 fragment series were captured in this interval. The graphs shown here represent all observed fragments -- both complete fragment series -- series in which all of the fragments were observed, and series with missing fragments. There are several reasons a series would have missing fragments, including some fragments taking different paths to the destination and consequently not traveling along the UCSD-CERF link, and fragments being dropped somewhere along the path between the source and our monitor box.

The number of bytes per fragment series corresponds to the size of the original packet, plus an additional header for each fragment. This graph has several interesting features. There is a concentration of smaller packets, which is to be expected since most machines don't try to send out packets larger than 1500 bytes. Also of note are the curve starting at around 10000 bytes, the second curve shadowing it starting around 12000 bytes, and thrid, similarly shaped curve of much smaller magnitude starting at around 30000 bytes.

        Top Ten                             Not Shown on graph:
        Bytes/Series    Complete Trace      Bytes/Series        Complete
Trace
        1540            8854427             170244              1
        1689            2436828             957784              1
        3826            846891              871624              1
        2616            726561              202360              1
        1694            704239              8867997             1
        3916            530681              185100              1
        1639            470480              153980              1
        3080            387543              78000               1
        3912            367885              81285               1
        1572            232685              491164              1
                                            76500               1
                                            569364              1
                                            83157               1
                                            276900              1
                                            352584              1
                                            368280              1
                                            79965               1
        

The curve evident in this graph appears to be almost the same as the curve in the bytes/series graph. Coincidence? Probably not.

        Top Ten                                 Not Shown on Graph:
        Fragments/Series    Complete Trace      Fragments/Series
Complete Trace
        2       14849154                        51      1
        3       2647790                         52      1
        4       505019                          58      1
        1       285740                          60      1
        6       94016                           64      1
        21      75508                           91      1
        5       71692                           97      1
        13      66403                           100     1
        14      65815                           210     1
        12      58701                           294     1
                                                374     1
                                                475     1
                                                575     1
                                                588     1
                                                1445    1
                                                2195    1
                                                7699    1
                                                8511    1
                                                9255    1
                                                13845   1
                                                17628   1
                                                18414   1
                                                24557   1
                                                28467   1
                                                43580   1
                                                47888   1
                                                305793  1
        

No fragments larger than 1500 bytes were observed. This is to be expected, since most links have an MTU of 1500 bytes. There is a random, "background" of sizes that spans from 44 to 1500 bytes from machines set to fragment traffic into infrequently used sizes of packets. There are many 1500 and 1484 byte packets, typical of ethernet and other link MTUs. There are also many 572 byte first fragments, a common PPP MTU.

        Top Ten
        First Fragment Size Complete Trace
        1484    9286933 4348    3
        1500    9131863
        0       313807
        1356    166105
        300     74812
        572     23715
        1492    14325
        124     13697
        1196    8878
        1468    4482
        44      3354
        

As with the first fragment sizes, the last fragment sizes have a wide 'background' range, which would be expected to be roughly half of the average of all of the fragments sizes.

        Top Ten                                 Not Shown On Graph:
        Last Fragment Size  Complete Trace      Last Fragment Size
Complete Trace
        56      9013120
        189     2447439
        826     869408
        1116    756657
        194     707683
        0       629266
        916     544779
        139     473642
        912     385459
        40      281446
        

The number of milliseconds for complete packet transmission has been shown to be independent of the number of packets in the series. This transmission time may be indicative of the line rate of the slowest router to handle the packet series after it is fragmented, the speed of the slowest link through which the packet series traveled, or the time difference between different paths taken by various fragments within a series.

        Milliseconds    Complete Trace
        0.5890131       764707
        0.5919933       743547
        0.5869865       741478
        0.5899668       624079
        0.5910397       611737
        0.5860329       500940
        0.5940199       498140
        0.5840063       398748
        0.5849600       397713
        0.5949736       393271