Ask Your Question
0

Packet length exceeds MSS

asked 2021-08-18 06:49:30 +0000

Jedi gravatar image

I am capturing between a computer and a router using a Dualcomm Network Tap.

I have noticed some packets that have a length that exceed the MTU of 1492 set in the router.

I did the capture from the wire for the specific purpose of avoiding the issue of Large Segment Offload.

I do not understand how there can be packets between the NIC and the router that exceed the MTU.

The operating system I am running Wireshark on for the capture is Ubuntu 20.04 using a separate NIC.

In case the NIC was doing Large Receive Offload I tried 

sudo ethtool --offload enp3s0 rx off

but it didn't help.

edit retag flag offensive close merge delete

Comments

Are you referring to the frame length, or IP length? Is it possible that the packets are fragmented and Wireshark provides the total length?

BigFatCat gravatar imageBigFatCat ( 2021-08-18 08:45:50 +0000 )edit
add a comment

1 Answer

Sort by ยป oldest newest most voted
0

answered 2021-08-18 14:05:48 +0000

Anders gravatar image

Hi, I think there is several settings to tune. https://blog.securityonion.net/2011/1...

edit flag offensive delete link more

Comments

Hi Anders,

Thank you for your very useful link.

For the record 

ethtool -K enp3s0 gro off

solved my problem.

This behaviour makes TCP sequence number analysis virtually impossible.

The importance of seeing the packets exactly how they are on the wire when trying to troubleshoot a problem can not be overstated. Your assistance is much appreciated.

Jedi gravatar imageJedi ( 2021-08-18 23:50:21 +0000 )edit

The other option is to not capture on the host, i.e. capture with a tap in front of the host, then you do actually see what's on the wire.

On host captures have a range of issues as the capture is made in the IP stack some way above the NIC hardware so you can't be sure what's actually going out on the wire.

grahamb gravatar imagegrahamb ( 2021-08-19 08:05:23 +0000 )edit

You may still have a problem with the system connected to the tap, as seen here.

Anders gravatar imageAnders ( 2021-08-19 08:34:27 +0000 )edit

Ahh, I see now, ugh, totally failed to read the original question. Leaving the comment there to remind me of my ineptness.

grahamb gravatar imagegrahamb ( 2021-08-19 08:52:00 +0000 )edit
add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

subscribe to rss feed

Stats

Asked: 2021-08-18 06:49:30 +0000

Seen: 1,300 times

Last updated: Aug 18 '21