I used a UDP socket (IPv4) sending 64KB packet to an end-system. When I capture the packets of end-system using Wireshark, I found that the IP Identification field of the reassembled IP datagram range from 0x0000-0x7fff(0-32767), i.e, when the end-system received a datagram with ID 0x7fff, the next datagram holds the id value of 0x0000 rather than 0x8000.
It confused me a lot. Why not 0x0000-0xffff(0-65536)?
My sender program is written with C# code, running on Windows7. Network interface card brand is Intel.
Please help.
The value of the identification field is a choice of the sender. It can be allocated in whatever fashion the sender likes. RFC 791 says this about it (emphasis added):
So the sending system is free to restrict its
identificationvalues to 0 - 0x7fff as long as any one datagram is "unique ... for the time the datagram will be active."