Skip to main content
bem336
New Member
May 14, 2012
Question

fragmentation

  • May 14, 2012
  • 2 replies
  • 4032 views
Hi all, i get below result when i do sniffing. from what i read, frag caused by MTU size but which device caused this? is it fortigate itself, switch or server? do we need to standardize mtu size for mentioned devices? this problem cost me intermittent snmp but show no timed out when pinging. 52.594763 X.X.X.X.161 -> X.X.X.X.64243: udp 8270 (frag 60968:1480@0+) 52.594768 X.X.X.X -> X.X.X.X: ip-proto-17 (frag 60968:1480@1480+) 52.594786 X.X.X.X -> X.X.X.X: ip-proto-17 (frag 60968:1480@2960+) 52.594800 X.X.X.X -> X.X.X.X: ip-proto-17 (frag 60968:1480@4440+) 52.594803 X.X.X.X -> X.X.X.X: ip-proto-17 (frag 60968:880@5920+) 52.594820 X.X.X.X -> X.X.X.X: ip-proto-17 (frag 60968:1478@6800) 52.594832 X.X.X.X.161 -> X.X.X.X.64243: udp 8270 (frag 60968:1480@0+) 52.594834 X.X.X.X.161 -> X.X.X.X.64243: udp 8270 (frag 60968:1480@0+) 52.594836 X.X.X.X -> X.X.X.X: ip-proto-17 (frag 60968:1480@1480+) 52.594838 X.X.X.X -> X.X.X.X: ip-proto-17 (frag 60968:1480@1480+) 52.594840 X.X.X.X -> X.X.X.X: ip-proto-17 (frag 60968:1480@2960+) 52.594841 X.X.X.X -> X.X.X.X: ip-proto-17 (frag 60968:1480@2960+) 52.594843 X.X.X.X -> X.X.X.X: ip-proto-17 (frag 60968:1480@4440+) 52.594845 X.X.X.X -> X.X.X.X: ip-proto-17 (frag 60968:1480@4440+) 52.594846 X.X.X.X -> X.X.X.X: ip-proto-17 (frag 60968:1480@5920+) 52.594848 X.X.X.X -> X.X.X.X: ip-proto-17 (frag 60968:1480@5920+) 52.594850 X.X.X.X -> X.X.X.X: ip-proto-17 (frag 60968:878@7400) 52.594851 X.X.X.X -> X.X.X.X: ip-proto-17 (frag 60968:878@7400)

    2 replies

    emnoc
    New Member
    May 14, 2012
    Will looking at it, the device ( SNMP enable host ) is sending packets that are huge. I don' t see this being a problem, since ip-fragmentation is being handle correct by the device. So maybe look at options to reduce the SNMP packet size.
    bem336
    bem336Author
    New Member
    May 21, 2012
    is there something i can do on the firewall itself?
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!