TCP length value is more than negotiated MSS [closed]

asked 2024-10-14 21:25:28 +0000

MahmutAydin gravatar image

Hello,

In my capture, mss value is 947 and 1460. so negotiated value is 947. But during file transfer, I see manu packets' tcp length more than 947. Could you please comment why this is happening?

regards,

edit retag flag offensive reopen merge delete

Closed for the following reason the question is answered, right answer was accepted by MahmutAydin
close date 2024-10-15 20:54:26.491303

Comments

Is the network interface configured for Offloading?
The frames may be the correct size on the wire but reassembled into larger packets before being passed to Wireshark.

Chuckc gravatar imageChuckc ( 2024-10-14 21:58:54 +0000 )edit

This device is F5. By default F5 is enabled for TSO. But I think it is capturing on CPU, so not directly from nic.

MahmutAydin gravatar imageMahmutAydin ( 2024-10-14 23:22:15 +0000 )edit

https://blog.securityonion.net/2011/1...

Anders gravatar imageAnders ( 2024-10-15 06:40:05 +0000 )edit
add a comment