What does (frag 16796:76@1376) mean?

• FortiGate

The output of the diagnose command diag snif packet ..., reveals the information:

16.342261 port5 -- 10.1.1.1 -> 192.168.100.100: ip-proto-6 (frag 16796:76@1376)

What does (frag 16796:76@1376) mean?

The numbers break down to <id>:<size>@<offset>

...where...

id = fragment identifier. The kernel will reassemble all fragments with same ID (for a given src&dst) into a single packet.
len = length of this fragment.
offset = the offset of this fragment in the fully re-assembled packet.

Since there is no "+" in the output, it means the above is the last fragment and therefore, unless the MTU is small, there are likely two fragments: one of 1376 bytes and one of 76, giving a total of 1452.