TCP length value is more than negotiated MSS

asked 2024-10-14 21:25:28 +0000

Hello,

In my capture, mss value is 947 and 1460. so negotiated value is 947. But during file transfer, I see manu packets' tcp length more than 947. Could you please comment why this is happening?

regards,

edit retag flag offensive close merge delete

Comments

@MahmutAydin I reopened the question, changed the comments to an answer stream and accepted that answer. This way the question and answer remain visible for others to learn from.

SYN-bit ( 2024-10-16 05:02:43 +0000 )edit

add a comment

1 Answer

Sort by » oldest newest most voted

answered 2024-10-14 21:58:54 +0000

Chuckc
3023 ●6 ●608 ●20

Is the network interface configured for Offloading?
The frames may be the correct size on the wire but reassembled into larger packets before being passed to Wireshark.

edit flag offensive delete link

Comments

This device is F5. By default F5 is enabled for TSO. But I think it is capturing on CPU, so not directly from nic.

MahmutAydin ( 2024-10-14 23:22:15 +0000 )edit

https://blog.securityonion.net/2011/1...

Anders ( 2024-10-15 06:40:05 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2024-10-14 21:25:28 +0000

Seen: 70 times

Last updated: Oct 14

TCP length value is more than negotiated MSS edit

Comments

1 Answer

Comments