ESX guest sending frames larger than MTU, yet negotiated MSS is 1460

["Manassypov, Igor" <IManassypov () ci com>]

Hi,

I am troubleshooting communication issues between windows ESX guest
communicating to microsoft App-V server via RTSP (tcp 514) protocol.
The client and server reside on different subnets with cisco router in
between. Configured MTU is 1500 all across.

Occasionally I get an ICMP destination unreachable, fragmentation needed
response kicked back at the client. Doing a concurrent capture at client
and server interfaces, I noticed that occasionally frames with sizes
much greater than MTU ( > 2000 ) arrive at the server with DF bit set,
which naturally get dropped. Each TCP stream negotiaties MSS of 1460.

If someone could help me understand how this behavior is possible, and
why would the packet not get dropped by the transit router? I've
hard-coded windows client MTU to 1500, and yet I am seeing these frames
being put on wire.

Here is the sample relevant output from the capture:


Maximum segment size: 1460 bytes

And yet within the same connection stream down the road:

Frame 316 (2974 bytes on wire, 96 bytes captured)


The MAC address of the frame received at the server is the mac address
of the transit cisco router as expected.


Thanks!



###################################################################################
This communication is confidential and may be 
privileged.  If you received it in error, please destroy 
without copying and advise the sender.

By submitting personal information to CI Investments, 
you agree to the collection, use and disclosure of 
such personal information for the purposes described 
in our Privacy Policy available at www.ci.com.


Cette communication est confidentielle et pourrait être 
privilégiée. Si vous la recevez par erreur, veuillez 
l'éliminer sans en faire une copie et aviser l'expéditeur.

Lorsque vous soumettez des renseignements 
personnels à Placements CI, vous nous permettez de 
conserver, utiliser et divulguer ces renseignements 
personnels aux fins décrites dans nos Principes 
directeurs en matière de protection des renseignements personnels 
qui sont disponibles au www.ci.com.

################################################################

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe