| the number of packets<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n We start with a payload length of 1408. As you can see we get the expected response.<\/p>\n C:\\Users\\rick>ping 192.168.1.10 -f -l 1408 -n 2\r\nPinging 192.168.1.10 with 1464 bytes of data:\r\nReply from 192.168.1.10: bytes=64 (sent 1464) time=39ms TTL=45\r\nReply from 192.168.1.10: bytes=64 (sent 1464) time=39ms TTL=45<\/pre>\nPing statistics for 192.168.1.10:
\nPackets: Sent = 2, Received = 2, Lost = 0 (0% loss),<\/p>\n We next up our payload length to 1409 bytes. However this time we can see that the packet is to large and requires fragmentation.<\/p>\n C:\\Users\\rick>ping 192.168.1.10 -f -l 1409 -n 2\r\nPinging 192.168.1.10 with 1465 bytes of data:\r\nPacket needs to be fragmented but DF set.\r\nPacket needs to be fragmented but DF set.<\/pre>\nPing statistics for 192.168.1.10:
\nPackets: Sent = 2, Received = 0, Lost = 2 (100% loss),<\/p>\n Based on these tests we take the maximum payload length (which is 1408 bytes) and subtract a further 12 bytes (because of TCP headers), leaving us with our optimal MSS.<\/p>\n MAXIMUM PAYLOAD LENGTH – 12 BYTES = OPTIMAL MSS<\/strong><\/p>\nNote<\/em>\u00a0<\/strong>: Based our optimal MSS value, the additional headers that would contribute to the remainder of the packet are,<\/p>\nMAXIMUM PAYLOAD (1408bytes) + IP HEADER (20bytes) + ICMP HEADER (8 bytes) + IPSEC HEADER (64 bytes) = 1500 MTU.<\/strong><\/p>\nThe interesting point here is that the IPSEC header size can change based on the ciphers used.<\/p>\n Note<\/strong><\/em> : The Cisco ASA clamps the MSS (of the inital SYN) in each direction.<\/p>\n |