Impossibly large frames in capture
Hello,
I have a packet capture that I've taken from SPANning a Cisco Nexus switchport. The switchport is connected to an esxi host that is running VSAN. In the capture I am seeing impossibly large frame sizes:
Frame 17927: 31926 bytes on wire (255408 bits), 31926 bytes captured (255408 bits)
I have confirmed that the MTU on the vswitch, vmk, physical nic, and nexus switch are all 1500. Additionally, the MSS in the initial three-way handshake of every single handshake in my capture is 1460. Regardless, the jumbo frames counters on the Nexuses are incrementing fairly regularly.
I've read forum posts of other people who've experienced this, but in all of those cases it seemed they were capturing at the source and the large frames were a byproduct of segment offloading or some other feature. I'm not capturing at the source, I'm capturing at an intermediary switch that definitely has a MTU of 1500. How could my capture have frames in it that would be impossible even if I was running jumbo frames?
