IP Identification filed = 0 in TCP packet

Unanswered Question
Feb 13th, 2008
User Badges:


In my production network, some server is placed behind load-balance devices(array) and a firewall. With sniffer, I found the servers sent many packetw with IP Identification field is 0, Does these packets are correct packets?


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
shrikar.dange Thu, 02/14/2008 - 00:43
User Badges:
  • Bronze, 100 points or more


I am not sure on this, correct me if I am wrong.In my opinion the identifier is only used in case of fragmentation.If the packet is sent unfragmented then that field will be zeros.Right?


shri :)

muthumohan Fri, 02/15/2008 - 12:58
User Badges:

Identification field is used for proper reassembly of the fragmented IP datagrams. The source host must put a unique value in this field before transmitting the IP datagram, even if it not fragmented. If this IP datagram happens to be fragmented by a router in the path (due to a smaller MTU), then this number is copied into all the fragments of the original IP datagram. The receiving host uses this number to identify the fragments of this IP datagram to reassemble and get the original IP datagram.

Read RFC 791 for more information.

Hope that helps a bit.

Thank you,


hetao1601 Tue, 02/19/2008 - 00:40
User Badges:

Thanks you, Shrikar

Does anyone know shri's right?


This Discussion