Description

This article explains the value in the Packet Length field from the command output of 'show firewall log detail'.

Solution

The Packet Length field in the output of ' show firewall log detail' command shows the value of Total Length field from the IPv4 header of the packet. Total Length field in the IPv4 header represents the total length of IP diagram (header and data) in bytes.

Whatever the source of the packet have in the "Total Length" field in the IP header, that is being printed in  "show firewall log detail" output on the destination.

Below are examples of the 'show firewall log detail ' command output when ICMP requests were sent from two different sources; Ixia and another Juniper device.


From Ixia:
                         dc38 e1e0 a3c0 0000 0000 0009 8100 000a
                         0800 4500 002e 0000 0000 4001 167b 0a20
                         2814 0a20 2801 0800 afae 0000 0000 0001
                         0203 0405 0607 0809 0a0b 0c0d 0e0f 1011
Frame 1 (64 bytes on wire, 64 bytes captured)
  Ethernet II, Src: 00:00:00_00:00:09 (00:00:00:00:00:09), Dst: dc:38:e1:e0:a3:c0 (dc:38:e1:e0:a3:c0)
  802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 10
  Internet Protocol, Src: 172.16.0.20 (172.16.0.20), Dst: 172.16.0.1 (172.16.0.1)
  Version: 4
  Header length: 20 bytes
  Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
  Total Length: 46 <-- Received length will be 46 bytes even though the total length is set to 64 bytes.
  Identification: 0x0000 (0)
  Flags: 0x00
  Fragment offset: 0
  Time to live: 64
  Protocol: ICMP (0x01)
  Header checksum: 0x167b [correct]
  Source: 172.16.0.20 (172.16.0.20)
  Destination: 172.16.0.1 (172.16.0.1)
  Internet Control Message Protocol
  0000 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f ................
  0010 10 11 .


From a switch:
                         ec3e f798 ebc0 ec3e f793 05c0 8100 00d3
                         0800 4500 0054 5b82 0000 4001 1b23 0101
                         0101 0101 0102 0800 5ef8 b089 0089 5824
                         c9f9 0005 5f6b eeee eeee eeee eeee eeee
                         eeee eeee eeee eeee eeee eeee eeee eeee
                         eeee eeee eeee eeee eeee eeee eeee eeee
                         eeee eeee
Frame 1 (80 bytes on wire, 80 bytes captured)
  Ethernet II, Src: ec:3e:f7:93:05:c0 (ec:3e:f7:93:05:c0), Dst: ec:3e:f7:98:eb:c0 (ec:3e:f7:98:eb:c0)
  802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 211
  Internet Protocol, Src: 192.168.0.1 (192.168.0.1), Dst: 192.168.0.2 (192.168.0.2)
  Version: 4
  Header length: 20 bytes
  Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
  Total Length: 84  
  Identification: 0x5b82 (23426)
  Flags: 0x00
  Fragment offset: 0
  Time to live: 64
  Protocol: ICMP (0x01)
  Header checksum: 0x1b23 [correct]
  Source: 192.168.0.1 (192.168.0.1)
  Destination: 192.168.0.2 (192.168.0.2)
  Internet Control Message Protocol
  0000 58 24 c9 f9 00 05 5f 6b ee ee ee ee ee ee ee ee X$...._k........
  0010 ee ee ee ee ee ee ee ee ee ee ee ee ee ee ee ee ................
  0020 ee ee .

Modification History

2022-07-22 - Modified IPs to RFC compliance. Article is still relevant.