Why Fragmentation

Imagine sending a large package across the world using multiple shipping carriers. One carrier accepts packages up to 50 kg, another only 20 kg, and a third just 10 kg. What do you do? You break the package into smaller pieces, ship them separately, and reassemble at the destination.

This is exactly what IP fragmentation does for network packets.

The Internet is not a single homogeneous network—it's an interconnection of thousands of networks built with different technologies, protocols, and hardware capabilities. What works perfectly on a high-speed fiber backbone may be too large for an aging DSL connection or a cellular network with strict size limitations. Fragmentation is the mechanism that allows IP to bridge these differences seamlessly.

The Internet's greatest strength is also the source of its greatest challenges: heterogeneity. Unlike early proprietary networks designed as monolithic systems, the Internet was architected to interconnect networks of vastly different types.

Consider the diverse technologies that constitute today's Internet:

The key insight: A packet originating on a network with large frame support (say, 9000-byte jumbo frames in a data center) may need to traverse networks that only support 1500-byte frames, or even smaller. Without fragmentation, such packets would simply be dropped—a catastrophic failure mode for reliable communication.

Historical Context:

When IP was designed in the late 1970s, the network landscape was even more diverse. The designers faced a fundamental choice:

1. Require all networks to support the same frame size — Impractical given existing infrastructure
2. Use the smallest common denominator — Wasteful and would cripple high-performance networks
3. Allow packets to be fragmented en route — Flexible but adds complexity

They chose option 3, embedding fragmentation directly into the IP protocol. This decision has shaped Internet architecture for over 40 years.

At the heart of fragmentation lies a concept called Maximum Transmission Unit (MTU)—the largest size of a packet or frame that can be transmitted in a single network transaction.

Key distinctions:

Why MTU sizes vary:

MTU is not arbitrary—it reflects careful engineering tradeoffs in protocol design:

Given heterogeneous MTUs across the Internet path, fragmentation becomes necessary when:

1. IP datagram larger than next-hop MTU:

When a router receives a packet destined for a network with a smaller MTU than the packet size, it has two choices:

• Fragment the packet into smaller pieces
• Drop the packet (if the Don't Fragment flag is set)

2. Source creates packets larger than path MTU:

Applications and transport protocols may generate data larger than the path can accommodate. Without fragmentation, communication would fail.

3. Tunneling increases overhead:

VPN tunnels, GRE encapsulation, and other overlays add headers, potentially pushing packets beyond MTU limits. This is a common source of fragmentation in modern networks.

The Fragmentation Process (Overview):

When a router determines fragmentation is necessary:

1. Calculate fragment size — Must be multiple of 8 bytes (IP header field constraint)
2. Divide payload — Split the IP payload into appropriately sized pieces
3. Create new IP headers — Each fragment gets its own IP header (20+ bytes)
4. Set fragmentation fields — Identification, Fragment Offset, More Fragments flag
5. Forward independently — Each fragment is routed as a separate packet

Critical insight: Only the destination host reassembles fragments. Intermediate routers never attempt reassembly—they only forward (or further fragment if necessary).

Understanding when fragmentation actually occurs in practice helps engineers design more efficient networks and applications. Here are the most common scenarios:

While fragmentation enables communication across heterogeneous networks, it comes with significant costs. Understanding these tradeoffs is essential for network design and troubleshooting.

Quantifying the Loss Multiplication Effect:

Consider a 4500-byte packet fragmented into 3 pieces with 1% packet loss on each hop:

• Single packet arrival probability: 99% per hop
• For 10 hops: 0.99¹⁰ = 90.4% single packet arrival
• For 3 fragments over 10 hops: (0.99¹⁰)³ = 73.9% complete delivery

Fragmentation reduces reliability from 90% to 74%—a 16 percentage point decrease. At higher loss rates or more fragments, this effect becomes devastating.

IP fragmentation, while necessary, has been exploited in numerous attacks over the decades. Understanding these vulnerabilities is crucial for network security professionals.

Modern Mitigations:

Networks and endpoints have developed various defenses:

• Reassemble-before-inspect — Firewalls and IDS systems reassemble fragments before applying rules
• Fragment limits — Rate-limit or drop fragmented packets entirely at network edge
• Timeout hardening — Short reassembly timeouts and low fragment buffer limits
• Random IPID — Prevent attackers from predicting identification field values
• IPv6 design — Routers cannot fragment; only source can, reducing attack surface

The lessons learned from decades of IPv4 fragmentation challenges fundamentally shaped IPv6 design. Understanding these differences illuminates both protocols' architectures.

Why IPv6 Prohibits Router Fragmentation:

1. Router efficiency — Fragmentation requires significant processing. Removing this from routers simplifies fast-path forwarding.

2. End-to-end visibility — Only the source knows the packet's full context. Fragmentation decisions are better made with this knowledge.

3. Attack surface reduction — Many fragmentation attacks relied on router fragmentation. Eliminating it removes these vectors.

4. Path MTU Discovery works — Modern Internet supports ICMP well enough for PMTUD to be reliable (with some exceptions).

The tradeoff: IPv6 is less tolerant of ICMP filtering. Networks that block ICMPv6 Packet Too Big break IPv6 entirely, not just PMTUD.