What Does the 'First Pak Frag' Counter Refer to?

This article applies to ScreenOS 4.0 and higher.

The 'first pak frag' counter registers fragmented packets being sent on a physical interface. If this counter is incrementing, this may indicate an issue with excessive packet fragmentation.

A common symptom of this issue is for web pages to not display properly in a browser. Many web servers block ICMP messages, causing the server to continue sending 1500-byte packets. Since these packets exceed the 1492 byte limit, the server continues to retransmit. These packets are dropped and as a result, the requested web site will not load.

Fragmentation is usually caused by one or more of the following factors:

• High MTU size (1500) setting on the Client/Server
• IPSec overhead
• PPPoE connections
• Large file transfers

Depending on the application, service, and type of transport used (TCP, IPSec encapsulation, clear text, etc.), the best method to prevent fragmentation issues is to set a proper MTU size on the client/server machines. This ensures that any overhead (IPSec, PPPoE, etc.) added to the datagram will not exceed the maximum MTU size of 1500 bytes.