How does the value of the Identification field change or stay the same for different packets? For instance, does it hold the same value for all packets in a TCP connection or does it differ for each packet? Is it the same in both directions? Can you see any pattern if the value does change?

How the value of the Identification field changes for different packets is explained in the explanation section. The value does not remain the same for all packets as the packet size may differ, changes will occur if the packet size exceed the maximum transmission unit (MTU) and needs to be fragmented to pass through a link with a smaller MTU.

Explanation:

IP fragmentation is an Internet Protocol (IP) process that breaks packets into smaller pieces or fragments small enough to pass through a link with a smaller maximum transmission unit (MTU) than the original packet size. The fragments are reassembled by the receiving host. A receiving host reassembles the fragmented IP packet and passes it onto a higher protocol layer. At times a network address translation (NAT) may need to reassemble fragments to translate data streams.

Under IPv4, a router has the option of fragmenting a network packet or drop the packet depending on whether the network packet larger than the next hop's MTU or not. In IPv6, routers do not have the option to fragment further, rather, network equipment is expected to deliver any IPv6 packets or packet fragments smaller than or equal to 1280 bytes. The optimal MTU through Path MTU Discovery is determined by the IPv6 hosts before sending packets. Though the header formats are different for IPv4 and IPv6, analogous fields are used for fragmentation, so the same algorithm can be reused for IPv4 and IPv6 fragmentation and reassembly.

FRAGMENTATION

Networks with different hardware usually vary not only in transmission speed but also in the maximum transmission unit (MTU). When one network wants to transmit datagrams to a network with a smaller MTU, it may fragment its datagrams. If the packet size received by an IPv4 router is bigger than the MTU, and the Do Not Fragment (DF) bit in the packet's header is set to 0, the router may fragment the packet. The max size of each fragment is the MTU minus the IP header size (20 bytes minimum; 60 bytes maximum). The router puts each fragment into its packet, each fragment packet having the following changes:

·        The total length: this field indicates the length of each fragment, not the length of the overall message field is the fragment size. This length is a multiple of 8, to allow proper offset. The last fragment will usually be shorter than others because it will contain a leftover piece unless the message length happens to be an exact multiple of the fragment size.

·        The more fragments (MF) flag: This flag is set to 1 for all fragments except the last one, which is set to 0. When the fragment with a value of 0 in the More Fragments flag is seen, the destination knows it has received the last fragment of the message.

·        The fragment offset: The problem of sequencing fragments can be solved by this field. This is done by indicating to the recipient device wherein the overall message each particular fragment should be placed. This is measured in units of eight-byte blocks.

The header checksum field is recomputed. For instance, for an MTU of 1,460 bytes and a header size of 20 bytes, the fragment offsets would be multiples of {\displaystyle {\frac {1500-20}{8}}=185}(1460-20)/8 = 180. These multiples are 0, 180, 360, 540, 720, ...

REASSEMBLY

A receiving host knows that a packet is a fragmented if at least one of the following conditions is true:

·        The More Fragments flag is set, which is true for all fragments except the last.

·        The Fragment Offset field is nonzero, which is true for all fragments except the first.

The receiver identifies matching fragments and reassembles the data from fragments with the same ID using both the fragment offset and the more fragments flag. When the last fragment is received by the receiver, which has the "more fragments" flag set to 0, the size of the original data payload can be calculated, by multiplying the last fragment's offset by eight and adding the last fragment's data size. Once the receiver has all fragments required, they can be reassembled in the correct sequence according to the offsets, to form the original datagram.

answer; i do believe its (faster);