More than 2 full TCP packets without ACK and large MTU

asked 2018-03-06 04:51:39 +0000

Vindra
13 ●2 ●7 ●11

updated 2018-03-06 07:38:29 +0000

Hi, Please refer to the attached pcapng file. It's an excerpt of a 1 GB PCAPNG.

It captures part of transfer of a 1GB FTP (port 21) transfer. I got two questions:

Q1) Packet # 16 through 22 were transferred without any acknowledgement. Each of those packets was more than TCP full size (1460). How is that possible?

Q2) Frame size of each of the above packets is more than the MTU size (1500). How is it possible?

Regards.

edit retag flag offensive close merge delete

Comments

It's not reasonable to expect people to download a 1.3 GB file and try to load it into Wireshark in order to tell you what's happening with seven packets. Cut the capture file down to a more reasonable size. To save packets 700 to 900, for example, you could enter a display filter of "frame.number > 699 && frame.number < 901". You can then go to File > Export Specified Packets to save off only the displayed packets.

Jim Aragon ( 2018-03-06 05:53:42 +0000 )edit

THANKS Jim, I just now reduced the file size following your advice

Vindra ( 2018-03-06 06:05:23 +0000 )edit

add a comment

answered 2018-03-06 08:08:50 +0000

Packet_vlad

1055 ●5 ●75 ●32 http://packettrain.net

updated 2018-03-06 11:20:51 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23790 ●4 ●950 ●227 https://www.wireshark.org

Always consider the point you're capturing on. You trace has strong signs of being captured on the sender itself.

Therefore:

Q1) As you're on the server itself, you just don't see ACKs because they had not come to you at the moment and still are somewhere on the path. It seems the sender has congestion window big enough to transmit packets 16...22 without waiting for an ACK.

Q2) This is because of "TCP segmentation offload". Please watch Paul Offord's cool video to grasp the concept:

https://www.youtube.com/watch?v=anEZG...

or take a look on wikipedia article Large Send Offload.

Comments

This link is quite useful too.

Anders ( 2018-03-06 09:15:32 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

More than 2 full TCP packets without ACK and large MTU

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

More than 2 full TCP packets without ACK and large MTU edit

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

More than 2 full TCP packets without ACK and large MTU