MF and DF Flags

Within the IPv4 header, three bits wield enormous influence over packet handling. These Flags bits—comprising Reserved, Don't Fragment (DF), and More Fragments (MF)—determine whether routers can break packets into pieces, whether Path MTU Discovery works, and how destination hosts know they've received all fragments.

Though tiny in size (just 3 bits out of the 160-bit minimum IPv4 header), these flags are referenced in almost every packet processing decision in the modern Internet. Understanding them deeply is essential for network engineering, troubleshooting, and security analysis.

The Flags field occupies 3 bits in the IPv4 header, immediately preceding the 13-bit Fragment Offset. Together, these 16 bits form the second half of the third 32-bit word in the header.

Binary representation examples:

The Don't Fragment (DF) flag is the most strategically important of the three bits. When set to 1, it instructs routers: "If this packet is too large for the next hop, do not fragment it—instead, drop it and send an ICMP error."

Why use DF flag?

1. Enable Path MTU Discovery — Setting DF forces ICMP feedback when packets are too large, allowing the source to discover the optimal packet size.

2. Avoid fragmentation overhead — Fragmentation adds headers, increases loss probability, and consumes router resources. DF prevents this.

3. Ensure atomic delivery — Some applications require packets to arrive whole or not at all. DF guarantees no silent fragmentation.

4. Security considerations — Fragmented packets can evade firewalls. DF ensures packets are inspected as complete units.

Default behavior:

Modern operating systems set DF=1 by default for TCP traffic (to enable PMTUD). UDP and ICMP typically have DF=0 unless explicitly set by the application.

The More Fragments (MF) flag signals whether additional fragments follow the current one. It's the mechanism that identifies the end of a fragment sequence.

How destination uses MF flag:

The receiving host uses MF to determine when reassembly is complete:

1. First fragment arrives (Offset=0, MF=1):

   • Create reassembly buffer
   • Store fragment's data starting at position 0
   • Note: more fragments expected

2. Middle fragments arrive (Offset>0, MF=1):

   • Add to reassembly buffer at offset × 8 position
   • More fragments still expected

3. Last fragment arrives (Offset>0, MF=0):

   • Add to reassembly buffer
   • Calculate total size: offset × 8 + data_length
   • Mark reassembly as having received final fragment

4. Check for completion:

   • If all bytes from 0 to total_size are present → reassemble
   • If gaps remain → wait (or timeout and discard)

Understanding all valid and invalid flag combinations helps in packet analysis and security assessment.

Analyzing suspicious combinations:

DF=1 with Offset>0 or MF=1: This combination means "this is a fragment, but don't fragment me." It's logically inconsistent—if DF was set when fragmentation occurred, fragmentation should have been blocked. This may indicate:

• Packet crafting/attack tools
• Implementation bugs
• Tunnels that strip/add headers incorrectly

Reserved bit = 1: Should never be set in normal traffic. May indicate:

• Network testing tools
• Malformed packets
• Rare experimental usage
• The source is jokingly referencing RFC 3514's "Evil Bit"

The DF flag is the cornerstone of Path MTU Discovery (PMTUD), the mechanism by which hosts learn the optimal packet size for a given path without trial and error.

TCP MSS adjustment:

When PMTUD discovers a smaller path MTU:

1. Route cache updated: "Path to 10.0.0.50 has MTU 1400"
2. For new TCP segments: MSS = 1400 - 40 = 1360 bytes
3. Existing connections may retransmit in-flight data at new size
4. Application sees no change—TCP handles transparently

The DF and MF flags have significant implications for firewall and security device operation. Understanding these is critical for security engineering.

Modern firewall approaches:

1. Virtual reassembly: Firewall tracks fragment state and logically reassembles for inspection without actually storing complete datagrams (memory efficient).

2. First-fragment minimum size: Require first fragment to contain complete transport header (20+ bytes of data beyond IP header). Drop tiny first fragments.

3. Drop all fragments: At network perimeter, simply block all fragmented traffic. Legitimate modern traffic should use PMTUD with DF=1 and not fragment.

4. Fragment rate limiting: Allow limited fragment rate to prevent DoS while permitting legitimate (rare) fragmented traffic.

Let's work through realistic scenarios showing how to interpret flags in packet captures.