Step by Step Analysis

These records appeared on the hourly wrap-up because ip.filter examines the IP header for any datagram that has the more fragments flag set and a zero fragment offset. This will display only the first fragment. The reason that this was done was to alert you of the fragmentation, yet not overwhelm you with all the records.