Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

How is these packets handled?

Hello :-)

I have a web server that often sending packets that are greater than MTU, while having the DF flag (Don't Fragment) set. This seemingly works 99% of the time, but I cannot understand how this functions underneath. See screenshot from wireshark here:

https://1drv.ms/u/s!Ar2R-UAQbAAomyFZuyxiqU-W5nMf?e=tIXg1N

Question is how is this handled?

The packet capture was done on the server itself and I was suspecting "Large Segment Offloading" to silently split these packet into MTU size ones. But is it allowed to do so with DF set? or will the NIC simply drop the packet even before it reaches the network.

Bonus info: This machine is located on a network where ICMP has been disabled, and I suspect this is why I never hear "Packet needs to be fragmented but DF set" back. Yet, like said, it seems to work almost all the time

Environment: Windows 10