# Incorrect orig\_bytes after ICMP6 reassembly
**URL:** https://community.zeek.org/t/incorrect-orig-bytes-after-icmp6-reassembly/3552
**Category:** Zeek
**Created:** [April 14, 2015, 11:39am UTC](https://community.zeek.org/t/incorrect-orig-bytes-after-icmp6-reassembly/3552 "2015-04-14T11:39:29Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Luuk\_Hendriks](https://community.zeek.org/u/Luuk_Hendriks)
#### Post date: [April 14, 2015, 11:39am UTC](https://community.zeek.org/t/incorrect-orig-bytes-after-icmp6-reassembly/3552/1 "2015-04-14T11:39:29Z")
Hi,
When analyzing a pcap containing fragmented ICMP6 packets, the resulting size (i.e. orig\_ip\_bytes) in conn.log is not the expected size. For example, a pcap containing only 46 fragments forming a single large ping request of ~65k bytes will result in a orig\_ip\_bytes of only 376. With some additional debug output in the code (Frag.cc) it seems that the reassembly does take place, and the offset reaches near the 65k mark. However, I was not able to figure out where things do go wrong. Is this a possible bug, or am I misinterpreting/misunderstanding things?
NB: My script contains 'redef ignore\_checksums=T;', as I'm working with a subset (via editcap) of a real capture.
Version information:
bro 2.3.2, compiled from stable tarball
(Arch) Linux, kernel 3.19
Thanks,
Luuk
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/incorrect-orig-bytes-after-icmp6-reassembly/3552/2 "2022-05-06T15:42:35Z")