Do you have a nic with "large segment offload" in the host where you
capture these large segments?
If so the packets will be split into smaller segments in the NIC
itself, below the point in the stack where you captured the packets.
On 2/5/07, Christophe Lohr <[EMAIL PROTECTED]> wrote:
> [EMAIL
[EMAIL PROTECTED] a écrit :
>
>
> It appears to be a mis-calculation of the length.
> If you subtract the sequence numbers in the first trace (2874589889 -
> 2874588441) you get 1448, the same value as in the second.
> I don't know the reason for the miscalculation, but the actual packet
> length d
[Wireshark-users] tcp packets too
big !?
02/02/2007 07:26
could it be that your linux is supporting and using jumbo frames? In
this case the MTU is much bigger
On 02.02.2007, at 14:26, Christophe Lohr wrote:
Hi,
Wireshark shows (outgoing) tcp packet with a surprising size,
larger than
mss...
Let's consider following "Client" and "Server":
* S
Hi,
Wireshark shows (outgoing) tcp packet with a surprising size, larger than
mss...
Let's consider following "Client" and "Server":
* Server [192.168.100.17] *
# tshark -n "host 192.168.100.11 && host 192.168.100.17 && port 7575" >
server.dump
# netcat -l -p 7575 > /dev/null
* Client [192.168.
