Wireshark-users: Re: [Wireshark-users] Large TCP packets
From: Sake Blok <[email protected]>
Date: Thu, 26 Jun 2008 07:25:10 +0200
On Wed, Jun 25, 2008 at 05:21:35PM -0700, Guy Harris wrote:
> 
> On Jun 25, 2008, at 11:54 AM, Martin Andersson wrote:
> 
> > I have a capture with very large tcp packets (it's a ftp session).  
> > My concern is that I can't see any IP fragments.
> 
> Perhaps either
> 
> 	1) there aren't any - if this is gigabit Ethernet, it might be using  
> jumbo frames:
> 
> 		http://en.wikipedia.org/wiki/Jumbo_Frame

In that case the MSS in the TCP options of the SYN packets would not
be 1460 and 1360 as they are in this trace...

> or
> 	2) the network adapter on the machine doing the capture is doing IP  
> fragment reassembly and passing simulated jumbo frames to the host

Martin stated that the capture was made on the FTP server, which for 
this connection is the sending host...

> or
> 	3) the network adapter on the machine is doing TCP segmentation  
> offloading on the receive side and passing simulated jumbo frames to  
> the host.

As the trace was made on the sending side, I suspect that the FTP
server is indeed offloading TCP segmentation to the NIC. If you want
to be sure, you could make a trace on the server and at the same time
on the client to verify that the large packets are indeed segmented
to normal sizes on the wire.

Cheers,
    Sake