Wireshark · Wireshark-users: Re: [Wireshark-users] TCP Segmentation Offload

[Guy Harris <guy@xxxxxxxxxxxx>]

Barry Constantine wrote:

> On NIC cards that provide TCP segmentation offload, pcap shows 
> artificially large packets since the NIC card does the segmentation.
>
> Is there any way for Wireshark to view these packets as they would 
> appear on the wire?  

Disable TSO on the adapter, or capture passively on the wire (mirror 
port on a switch, hub, etc.).  Libpcap gets what the underlying packet 
capture mechanism gives it, and, if the driver gets reassembled 
segments, that's all that the driver can hand the packet capture mechanism.

There's no way for Wireshark to reconstruct the information that was not 
supplied by the NIC to the host due to the NIC doing reassembly, so 
there's no way for Wireshark to show you what the capture looked like on 
the wire.