TCP much larger than 1460 bytes?

asked 2019-10-12 07:57:01 +0000

kuchenmann
3 ●3 ●2

I do not understand, why a see a lot of packets much larger than 1460 bytes. On different Win10 devices in my LAN. The network adapters on the devices are set to MTU 1500, switch has MTU 1518. No device in my LAN has MTU more than 1518 bytes. The MSS in the SYN-packets show 1460 bytes. Why are there packets with much more than 1460 bytes?

14021 09:51:25,644834    0.000093       192.168.1.4           104.xx.yyy.zz         TCP      11254  50004 → 443 [ACK] Seq=34207 Ack=3156 Win=4122 Len=11200 [TCP segment of a reassembled PDU]

answered 2019-10-12 09:34:58 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23835 ●4 ●973 ●227 https://www.wireshark.org

Modern NICs and their drivers can handle many networking tasks and among them is segmentation offloading and this leads to the capture library recording these larger packets.

See the Wiki page on offloading for more info.

Incidentally yet another reason to not perform captures on the host systems themselves.

edit flag offensive delete link

Comments

Thanks for explanation.

kuchenmann ( 2019-10-12 12:18:38 +0000 )edit

If an answer has solve your issue, for the benefit of others with the same question, please accept the answer by clicking the checkmark to the left of the answer.

grahamb ( 2019-10-12 13:17:07 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

TCP much larger than 1460 bytes?

1 Answer

Comments

Your Answer

Question Tools

Stats

TCP much larger than 1460 bytes? edit

1 Answer

Comments

Your Answer

Question Tools

Stats

TCP much larger than 1460 bytes?