I am wondering if anyone can help me to to confirm if tcpdump on MacOS can show packet size bigger than MSS.
I run scp to copy files between a MacOS machine and a Linux VM and tcpdump on both side to capture the traffic. I noticed on Linux side, the tcp.len can be much bigger (close to 64KB) than the MSS size for both direction; but the capture on MacOS side shows the maximum tcp.len is always MSS - tcp.options length.
I think the bigger tcp.len on Linux is the result of TCP segmentation offload, the CPU send big packet to Nic and let Nic do the dirty work. On MacOS side, "sysctl net.inet.tcp.tso" shows "net.inet.tcp.tso: 1 ", so I thought it should also show bigger tcp.len, but the captured file shows different.
Can anybody confirm this is the normal behavior on MacOS ? Is so, how do we know TSO is working on MacOS ?
Thanks, Jack
