Ask Your Question
0

Waht is the minimum MSS captured by wireshark?

asked 2022-04-20 19:29:57 +0000

I found out that the default MSS is 536 bytes, is that what the wireshark will capture or can be there be a lower MSS that gets captured?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2022-04-21 09:21:23 +0000

Jaap gravatar image

The MSS has nothing to do with packet capture. MSS is a setting of the TCP/IP stack to define what the TCP segment size may be, so from 0 up to MSS. And Wireshark will happily dissect TCP packets with segments of any size.

edit flag offensive delete link more

Comments

And note that the "default" MSS is usually not the MSS that's used. An Ethernet packet has a maximum payload of 1500 bytes, an IPv4 header is a minimum of 20 bytes long, and a TCP header is a minimum of 20 bytes long, so the maximum TCP payload is 1500-(20+20) = 1460 bytes. That's the usual MSS that's negotiated.

Wireshark will, by default, capture the entire packet, however big that might be; as Jaap notes, that is not affected by the MSS.

Guy Harris gravatar imageGuy Harris ( 2022-04-22 08:56:45 +0000 )edit

While it looks like a MSS value is been negotiated, it is actually announced (advertised) in each of the two flows individually, instead of being negotiated.

Sidenote: This can lead to problems when routes are assymetrical over links with different MSS adjustments due to different MTU sizes or different amounts of encapsulation of each link.

SYN-bit gravatar imageSYN-bit ( 2022-04-24 15:16:59 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2022-04-20 19:29:57 +0000

Seen: 489 times

Last updated: Apr 21 '22