How would you view and analyze IP fragmentation in Wireshark?

• A. Filter with tcp.analysis flags only
• B. Filter with ip.frag_offset or ip.more_frag to see fragments and use IP reassembly
• C. Use http2 filter
• D. Search DNS records

Answer: (B)

Viewing and analyzing IP fragmentation in Wireshark hinges on reading the IPv4 fragment indicators and turning on reassembly. Fragments carry fields that show their position and whether more pieces follow: the fragment offset tells you where a fragment belongs in the original datagram, and the more-fragments flag indicates if additional fragments are coming. Filtering by these fields lets you surface all pieces of fragmented traffic, so you can see how a single IP datagram was split across multiple packets.

Once you can see the fragments, enable IP reassembly in Wireshark. This lets Wireshark reconstruct the original IP datagram from the fragments and display a single, coherent view of the complete payload, making it easier to analyze the higher-layer protocol that was fragmented. You can also use the IP identification, source, and destination to group fragments belonging to the same datagram.

Other options don’t fit because they target different traffic aspects: filtering by TCP analysis flags focuses on TCP-level events rather than IP fragmentation; HTTP/2 filtering is about the HTTP/2 protocol; DNS records have no direct role in reconstructing fragmented IP datagrams.