> Good question. I was wondering about that as well after I sent my original
> note. This was on a 16Mb token ring network, and the apparently default
> mtu for the driver I'm using is 2000. I was regularly seeing packets that
> were between 4000 and 4500 bytes. I changed the mtu to 4500, but would
> still occasionally see even bigger packets. Seems like the actual maximum
> packet size for 16Mb token ring is something like 16k or 18k.
Duh, I'm stupid. Maximum Transmitted Unit != Maximum Received Unit;
setting the MTU affects only the packets transmitted by the machine -
other machines might well transmit larger packets, if the underlying
link layer allows it.
This would also explain why this problem hasn't been reported before
this - on Ethernet, which is probably the most common link layer on
which libpcap-based programs are run, the MTU and MRU are typically 1500
bytes, and typically not changed.
I'll look at cleaning the code up so that it doesn't assume that the MTU
is also the MRU.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
