We do TCP data transmission more than 1500bytes so the packets are sent as tcp segmented packets but not visible in wireshark but in CANoe segmentation visible.what is the reason?

asked 2023-11-07 03:59:32 +0000

soundharyar
1

Sending 30,000 bytes as -> 8192 -> 8192 bytes. The inner segmentation 8192 -> 1460 -> 1460 -> 1460 -> 1460 -> 892 not visible in wireshark shown as 8192 but acknowledgement for segmentation only

answered 2023-11-07 08:57:03 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23790 ●4 ●951 ●227 https://www.wireshark.org

Likely to be because you're capturing on the local machine and the capture library acquires the packets before other layers in the network stack segment the TCP PDUs.

To see the "true" messages on the wire you need to capture off machine, e.g. using a tap, a switch mirror port or intermediate router that can create captures.

edit flag offensive delete link

Comments

This type of capture is observed only in some of the PC , other PC we could observe the true message in Host PC itself, is there any possiblity to change this behaviour

soundharyar ( 2023-11-07 09:07:09 +0000 )edit

Depends on the OS used, there are various options to disable TCP offload.

grahamb ( 2023-11-07 10:38:21 +0000 )edit

Thanks. In Network Adaptor the "Large send Offload" I tried to disabled and checked if able to reproduce this issue on other host pc. But not possible. Could you suggest a way to disable the TCP offload

soundharyar ( 2023-11-07 11:30:35 +0000 )edit

That's not really a Wireshark question, you'll probably need to take it to an appropriate OS forum

grahamb ( 2023-11-07 11:44:20 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

We do TCP data transmission more than 1500bytes so the packets are sent as tcp segmented packets but not visible in wireshark but in CANoe segmentation visible.what is the reason?

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

We do TCP data transmission more than 1500bytes so the packets are sent as tcp segmented packets but not visible in wireshark but in CANoe segmentation visible.what is the reason? edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

We do TCP data transmission more than 1500bytes so the packets are sent as tcp segmented packets but not visible in wireshark but in CANoe segmentation visible.what is the reason?