What does (frag 16796:76@1376) mean?

[#1]

Article

Description	What does (frag 16796:76@1376) mean?
Components	FortiGate
Steps or Commands	The output of the diagnose command diag snif packet ..., reveals the information: 16.342261 port5 -- 10.1.1.1 -> 192.168.100.100: ip-proto-6 (frag 16796:76@1376) What does (frag 16796:76@1376) mean? The numbers break down to <id>:<size>@<offset> ...where... id = fragment identifier. The kernel will reassemble all fragments with same ID (for a given src&dst) into a single packet. len = length of this fragment. offset = the offset of this fragment in the fully re-assembled packet. Since there is no "+" in the output, it means the above is the last fragment and therefore, unless the MTU is small, there are likely two fragments: one of 1376 bytes and one of 76, giving a total of 1452.