tunnels, mtu and payload length

[Eugene M. Zheganin]

Hi.

Can someone explain me where are the 4 missing bytes when capturing
traffic on a gif interface with a tcpdump ?
I expect to see the length of the first fragment (offset = 0) to be
equal to an mtu (1280 bytes), but clearly it's 1276 bytes.
Same thing happens to a gre tunnel.

# ifconfig gif0
gif0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1280
        tunnel inet 192.168.3.24 --> 192.168.3.17
        inet 172.16.5.40 --> 172.16.5.41 netmask 0xffffffff
        inet6 fe80::21a:64ff:fe21:8e80%gif0 prefixlen 64 scopeid 0x1c
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>

# ping -s 4096 172.16.5.41
PING 172.16.5.41 (172.16.5.41): 4096 data bytes
4104 bytes from 172.16.5.41: icmp_seq=0 ttl=64 time=0.837 ms
4104 bytes from 172.16.5.41: icmp_seq=1 ttl=64 time=0.870 ms
4104 bytes from 172.16.5.41: icmp_seq=2 ttl=64 time=0.779 ms
4104 bytes from 172.16.5.41: icmp_seq=3 ttl=64 time=0.823 ms
4104 bytes from 172.16.5.41: icmp_seq=4 ttl=64 time=0.794 ms

tcpdump:

12:58:33.430450 IP (tos 0x0, ttl 64, id 40760, offset 0, flags [+],
proto ICMP (1), length 1276)
    172.16.5.40 > 172.16.5.41: ICMP echo request, id 62980, seq 17,
length 1256
12:58:33.430467 IP (tos 0x0, ttl 64, id 40760, offset 1256, flags [+],
proto ICMP (1), length 1276)
    172.16.5.40 > 172.16.5.41: ip-proto-1
12:58:33.430481 IP (tos 0x0, ttl 64, id 40760, offset 2512, flags [+],
proto ICMP (1), length 1276)
    172.16.5.40 > 172.16.5.41: ip-proto-1
12:58:33.430494 IP (tos 0x0, ttl 64, id 40760, offset 3768, flags
[none], proto ICMP (1), length 356)
    172.16.5.40 > 172.16.5.41: ip-proto-1

Thanks.
Eugene.