Ask Your Question

We do TCP data transmission more than 1500bytes so the packets are sent as tcp segmented packets but not visible in wireshark but in CANoe segmentation visible.what is the reason?

asked 2023-11-07 03:59:32 +0000

Sending 30,000 bytes as -> 8192 -> 8192 bytes. The inner segmentation 8192 -> 1460 -> 1460 -> 1460 -> 1460 -> 892 not visible in wireshark shown as 8192 but acknowledgement for segmentation only

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2023-11-07 08:57:03 +0000

grahamb gravatar image

Likely to be because you're capturing on the local machine and the capture library acquires the packets before other layers in the network stack segment the TCP PDUs.

To see the "true" messages on the wire you need to capture off machine, e.g. using a tap, a switch mirror port or intermediate router that can create captures.

edit flag offensive delete link more


This type of capture is observed only in some of the PC , other PC we could observe the true message in Host PC itself, is there any possiblity to change this behaviour

soundharyar gravatar imagesoundharyar ( 2023-11-07 09:07:09 +0000 )edit

Depends on the OS used, there are various options to disable TCP offload.

grahamb gravatar imagegrahamb ( 2023-11-07 10:38:21 +0000 )edit

Thanks. In Network Adaptor the "Large send Offload" I tried to disabled and checked if able to reproduce this issue on other host pc. But not possible. Could you suggest a way to disable the TCP offload

soundharyar gravatar imagesoundharyar ( 2023-11-07 11:30:35 +0000 )edit

That's not really a Wireshark question, you'll probably need to take it to an appropriate OS forum

grahamb gravatar imagegrahamb ( 2023-11-07 11:44:20 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools


Asked: 2023-11-07 03:59:32 +0000

Seen: 132 times

Last updated: Nov 07 '23