Wireshark · Wireshark-users: Re: [Wireshark-users] MTU - wireshark showing length longer than.

[Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>]

On Nov 25, 2009, at 9:27 AM, Ant Mitchell wrote:

> What should I be looking at ?, how does the packet size get larger
> than the MTU ?. A typical size is 8960 for several packets, then 17960
> and 20456 and several inbetween.

The NICs may be doing segmentation offloading, which reassembles TCP  
Segments before passing it to the computer:

  http://wiki.wireshark.org/CaptureSetup/Offloading


Steve