Re: why I'm capturing packets larger than MTU size

[Rick Jones <rick.jones2 () hp com>]

On 02/23/2012 06:31 AM, Andriy Tylychko wrote:
> I capture network traffic on Debian 5 and 6 with libpcap v. 1.2.1 compiled
> from sources. Then I send these traffic by pcap_sendpacket(). Sometimes
> there're packets (both TCP and UDP) larger than default MTU size (1500
> bytes). I cannot send these packets with error: "send error:
> packetSendPacket failed". Found this post:
> http://seclists.org/tcpdump/2007/q2/112 "[Patch] libpcap support for IP
> fragment reassembly", but I didn't enable such reassemply.
>
>
>
> How can I disable this reassempling?

The NIC might support LRO (Large Receive Offload) in which case it could 
be coalescing consecutive TCP segments.  It may also support IP fragment 
reassembly.

Even if the NIC does not support LRO, in "new enough" Linux kernels 
there is GRO, a segment coalescing just bove the driver in the 
networking stack.

Disabling GRO is done via ethtool -K.  LRO too, though go back far 
enough and it may need to be done at the module parameter level.  I 
don't know if UFO (UDP Fragmentation Offload) is both directions or not, 
but that too is an ethtool -K thing.

rick jones
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.