What is so important about network frame size?

balcobulls

I constantly see tutorials of conducting pings. Many steps are focused around finding the exact frame size of the network you are seeking. How can finding the exact frame size assist me in footprinting and/or scanning a network?

Thank you for your time and answers!

exspiravit

It can help with T/S in the sense that if a network device is sending jumbo frames and other devices aren't set for that you'll have problems. It also tells you the payload size which could be used for malformed packet injection. If, say, the frame size is 2000 bytes and you try a smaller, more standard 1518 bytes (or so), you'll have a fragmented packet which will throw a flag, somewhere (maybe). So, if you want to pentest a system you should know the frame sizes for all the different domains, legs, nodes, what have you, etc.

Some times, the internal network will have a smaller size and then when you go towards your ISP you might start to aggregate and use jumbo framing to max out throughput. So, with that bit of knowledge, if the devices you have access to have above normal frame sizes you are closer to the external architecture (ISP) and smaller could be more internal, or something.

I'm not an expert, I just know some things. I'm sure someone will correct me.

balcobulls

Thank you for you response, taking your statement I can definitely find the benefits now.