Packet length exceeds MSS

asked 2021-08-18 06:49:30 +0000

Jedi
7 ●2 ●4 ●5

I am capturing between a computer and a router using a Dualcomm Network Tap.

I have noticed some packets that have a length that exceed the MTU of 1492 set in the router.

I did the capture from the wire for the specific purpose of avoiding the issue of Large Segment Offload.

I do not understand how there can be packets between the NIC and the router that exceed the MTU.

The operating system I am running Wireshark on for the capture is Ubuntu 20.04 using a separate NIC.

In case the NIC was doing Large Receive Offload I tried

sudo ethtool --offload enp3s0 rx off

but it didn't help.

Comments

Are you referring to the frame length, or IP length? Is it possible that the packets are fragmented and Wireshark provides the total length?

BigFatCat ( 2021-08-18 08:45:50 +0000 )edit

add a comment

answered 2021-08-18 14:05:48 +0000

Anders

5023 ●97 ●58

Hi, I think there is several settings to tune. https://blog.securityonion.net/2011/1...

edit flag offensive delete link

Comments

Hi Anders,

Thank you for your very useful link.

For the record

ethtool -K enp3s0 gro off

solved my problem.

This behaviour makes TCP sequence number analysis virtually impossible.

The importance of seeing the packets exactly how they are on the wire when trying to troubleshoot a problem can not be overstated. Your assistance is much appreciated.

Jedi ( 2021-08-18 23:50:21 +0000 )edit

The other option is to not capture on the host, i.e. capture with a tap in front of the host, then you do actually see what's on the wire.

On host captures have a range of issues as the capture is made in the IP stack some way above the NIC hardware so you can't be sure what's actually going out on the wire.

grahamb ( 2021-08-19 08:05:23 +0000 )edit

You may still have a problem with the system connected to the tap, as seen here.

Anders ( 2021-08-19 08:34:27 +0000 )edit

Ahh, I see now, ugh, totally failed to read the original question. Leaving the comment there to remind me of my ineptness.

grahamb ( 2021-08-19 08:52:00 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Packet length exceeds MSS

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Packet length exceeds MSS edit

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Packet length exceeds MSS