Ask Your Question
0

Impossibly large frames in capture

asked 2019-05-02 18:58:09 +0000

Hello,

I have a packet capture that I've taken from SPANning a Cisco Nexus switchport. The switchport is connected to an esxi host that is running VSAN. In the capture I am seeing impossibly large frame sizes:

Frame 17927: 31926 bytes on wire (255408 bits), 31926 bytes captured (255408 bits)

I have confirmed that the MTU on the vswitch, vmk, physical nic, and nexus switch are all 1500. Additionally, the MSS in the initial three-way handshake of every single handshake in my capture is 1460. Regardless, the jumbo frames counters on the Nexuses are incrementing fairly regularly.

I've read forum posts of other people who've experienced this, but in all of those cases it seemed they were capturing at the source and the large frames were a byproduct of segment offloading or some other feature. I'm not capturing at the source, I'm capturing at an intermediary switch that definitely has a MTU of 1500. How could my capture have frames in it that would be impossible even if I was running jumbo frames?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
1

answered 2019-05-02 19:30:46 +0000

SYN-bit gravatar image

Have you checked the offloading settings of the capture system? I have had this happen to me when capturing on a linux box with Large Receive Offloading enabled. The NIC will combine the packets before sending it to the OS. It's best to turn off all offloading features of the NIC on the capturing system.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2019-05-02 18:58:09 +0000

Seen: 55 times

Last updated: May 02