Ask Your Question
0

More than 2 full TCP packets without ACK and large MTU

asked 2018-03-06 04:51:39 +0000

Vindra gravatar image

updated 2018-03-06 07:38:29 +0000

Hi, Please refer to the attached pcapng file. It's an excerpt of a 1 GB PCAPNG.

It captures part of transfer of a 1GB FTP (port 21) transfer. I got two questions:

Q1) Packet # 16 through 22 were transferred without any acknowledgement. Each of those packets was more than TCP full size (1460). How is that possible?

Q2) Frame size of each of the above packets is more than the MTU size (1500). How is it possible?

Regards.

edit retag flag offensive close merge delete

Comments

It's not reasonable to expect people to download a 1.3 GB file and try to load it into Wireshark in order to tell you what's happening with seven packets. Cut the capture file down to a more reasonable size. To save packets 700 to 900, for example, you could enter a display filter of "frame.number > 699 && frame.number < 901". You can then go to File > Export Specified Packets to save off only the displayed packets.

Jim Aragon gravatar imageJim Aragon ( 2018-03-06 05:53:42 +0000 )edit

THANKS Jim, I just now reduced the file size following your advice

Vindra gravatar imageVindra ( 2018-03-06 06:05:23 +0000 )edit
add a comment

1 Answer

Sort by ยป oldest newest most voted
1

answered 2018-03-06 08:08:50 +0000

Packet_vlad gravatar image

updated 2018-03-06 11:20:51 +0000

grahamb gravatar image

Always consider the point you're capturing on. You trace has strong signs of being captured on the sender itself.

Therefore:

Q1) As you're on the server itself, you just don't see ACKs because they had not come to you at the moment and still are somewhere on the path. It seems the sender has congestion window big enough to transmit packets 16...22 without waiting for an ACK.

Q2) This is because of "TCP segmentation offload". Please watch Paul Offord's cool video to grasp the concept:

https://www.youtube.com/watch?v=anEZG...

or take a look on wikipedia article Large Send Offload.

edit flag offensive delete link more

Comments

1

This link is quite useful too.

Anders gravatar imageAnders ( 2018-03-06 09:15:32 +0000 )edit
add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

subscribe to rss feed

Stats

Asked: 2018-03-06 04:51:39 +0000

Seen: 336 times

Last updated: Mar 06 '18