TCP packet length was much greater than MTU [closed]
Refering to this question in the old Wireshark forum:
The issue is: Wireshark shows TCP frame length being much greater than the maximum TCP frame length of 1500 bytes.
The explanation is: "Probably you captured on the host that transmitted the oversized packet, and TCP Large Segment Offload [TSO] is enabled"
Now I found a good tutorial on how to disable TOS on Linux and I want to share it with you:
sudo apt install ethtool
ethtool --show-offload eth0 //shows, if tcp-segmentation-offload is enabled
sudo ethtool -K eth0 gso off
sudo ethtool -K eth0 tso off
I experienced the same just the other way around on the receiving client side, the reason for that was Large Receive Offload [LRO]. It can be disabled like this:
sudo ethtool -K eth0 tso off
Note that this step is only possible, when LRO isn't set as [FIXED]. You can check this with:
ethtool --show-offload eth0
large-receive-offload: on [fixed] //check in the output
What is your question?
Great you have slowed down your network performance!
For some people who are wondering about the frame length they can measure with Wireshark, this might be a good explanation. I was wondering about this issue and had to do quite a lot of research to get all this information.
So no question, but helpful for people who are having the same question.
Well, a couple of things:
1) From the Help:
This site is for asking and answering questions, not for open-ended discussions.
If you'd like to share general information about Wireshark, then maybe the wireshark-users or wireshark-dev mailing lists are the more appropriate forums to do so.
2) As Christian mentions, what you've done is generally poor advice as you've hindered performance. It's one thing to understand what's going on, but quite another to make unnecessary and performance-degrading changes in order for the capture files to show what you expect. It's as if you were trying to take a picture of a Formula 1 racecar zooming past you, but because the photograph always came out blurry, you decided to replace the Formula 1 engine with that of a Peel P50. You're now taking great photographs, but you've completely missed the point of the ...(more)
For those coming to this question in the hope of configuring their NIC properly for capture, please see https://blog.packet-foo.com/2016/11/t... and the SecurityOnion reference that's linked to from that page.