Re: How can a packet size be greater than the NIC's MTU?

[Mohamed Lrhazi <lrhazi () gmail com>]

On Tue, Dec 3, 2013 at 11:16 PM, Shawn Carroll <shawnthomascarroll () yahoo com
> wrote:

> IP fragmentation



I am not sure this is about IP fragmentation... well, maybe, but tcpdump
-vvvv -r my.pcap.file still shows just one packet with that big size... and
in wireshark, with "Reassemble IPv4 fragmented datagrams" disabled, I still
see a single packet with that bigger than Ethernet MTU size.

So, if the packet I am seeing is actually several IP datagrams... how can I
prove it to myself, but getting wireshark or other tool, to show me the
unique datagrams and their respective sizes and other L2 details?

I'd like to be able to track the problem to: See, this datagram left this
NIC and never made it to this other NIC, on this other device.... while
these smaller one did.

I can share the pcap.... if need be. What's this lists best way of sharing
a pcap file? The pcaps I took were with "tcpdump -s0 -w /tmp/file.pcap"

Thanks a lot,
Mohamed.

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe