Wireshark-users: Re: [Wireshark-users] TCP Segmentation Offload

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 07 May 2008 10:58:48 -0700

Barry Constantine wrote:

On NIC cards that provide TCP segmentation offload, pcap shows artificially large packets since the NIC card does the segmentation.

Is there any way for Wireshark to view these packets as they would appear on the wire?

Disable TSO on the adapter, or capture passively on the wire (mirror port on a switch, hub, etc.). Libpcap gets what the underlying packet capture mechanism gives it, and, if the driver gets reassembled segments, that's all that the driver can hand the packet capture mechanism.

There's no way for Wireshark to reconstruct the information that was not supplied by the NIC to the host due to the NIC doing reassembly, so there's no way for Wireshark to show you what the capture looked like on the wire.