Ask Your Question
0

TCP much larger than 1460 bytes?

asked 2019-10-12 07:57:01 +0000

kuchenmann gravatar image

I do not understand, why a see a lot of packets much larger than 1460 bytes. On different Win10 devices in my LAN. The network adapters on the devices are set to MTU 1500, switch has MTU 1518. No device in my LAN has MTU more than 1518 bytes. The MSS in the SYN-packets show 1460 bytes. Why are there packets with much more than 1460 bytes?

14021 09:51:25,644834    0.000093       192.168.1.4           104.xx.yyy.zz         TCP      11254  50004 → 443 [ACK] Seq=34207 Ack=3156 Win=4122 Len=11200 [TCP segment of a reassembled PDU]
edit retag flag offensive close merge delete

1 Answer

Sort by » oldest newest most voted
0

answered 2019-10-12 09:34:58 +0000

grahamb gravatar image

Modern NICs and their drivers can handle many networking tasks and among them is segmentation offloading and this leads to the capture library recording these larger packets.

See the Wiki page on offloading for more info.

Incidentally yet another reason to not perform captures on the host systems themselves.

edit flag offensive delete link more

Comments

Thanks for explanation.

kuchenmann gravatar imagekuchenmann ( 2019-10-12 12:18:38 +0000 )edit

If an answer has solve your issue, for the benefit of others with the same question, please accept the answer by clicking the checkmark to the left of the answer.

grahamb gravatar imagegrahamb ( 2019-10-12 13:17:07 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2019-10-12 07:57:01 +0000

Seen: 36 times

Last updated: Oct 12