I used a UDP socket (IPv4) sending 64KB packet to an end-system. When I capture the packets of end-system using Wireshark, I found that the IP Identification field of the reassembled IP datagram range from 0x0000-0x7fff(0-32767), i.e, when the end-system received a datagram with ID 0x7fff, the next datagram holds the id value of 0x0000 rather than 0x8000.
It confused me a lot. Why not 0x0000-0xffff(0-65536)?
My sender program is written with C# code, running on Windows7. Network interface card brand is Intel.
Please help.
The value of the identification field is a choice of the sender. It can be allocated in whatever fashion the sender likes. RFC 791 says this about it (emphasis added):
The identification field is used to distinguish the fragments of one datagram from those of another. The originating protocol module of an internet datagram sets the identification field to a value that must be unique for that source-destination pair and protocol for the time the datagram will be active in the internet system. The originating protocol module of a complete datagram sets the more-fragments flag to zero and the fragment offset to zero.
So the sending system is free to restrict its identification values to 0 - 0x7fff as long as any one datagram is "unique ... for the time the datagram will be active."