Wireshark mailing list archives
Bytes on wire/bytes captured for TCP traffic is larger than MTU
From: Mark Ryden <markryde () gmail com>
Date: Sat, 9 Oct 2010 16:13:34 +0200
Hello, I am sniffing with wireshark TCP iperf traffic on a machine where the NIC has an ordinary NIC. The MTU of the NIC on the client and the server is the default value (1500). I see in the sniff that some of the frames have (2962 bytes on wire,2962 bytes captured) and also that the ip header Total length is 2948. My question is: how can it be that I am getting size of a packet which is almost twice the size of MTU ? AFAIK, you cannot receive/send packets larger than the MTU without fragmentation, and what I see does not show fragmentation. Rgs, Mark Ryden ___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- Bytes on wire/bytes captured for TCP traffic is larger than MTU Mark Ryden (Oct 09)
- Re: Bytes on wire/bytes captured for TCP traffic is larger than MTU Chris Alton (Oct 09)