ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: Re: [Wireshark-users] MTU - wireshark showing length longer than.

From: Ant Mitchell <ant@xxxxxxxxxxxx>
Date: Wed, 25 Nov 2009 20:48:21 +0000

The NICs may be doing segmentation offloading, which reassembles TCP
Segments before passing it to the computer:


Good idea, maybe so !. Turned it off:
sudo /sbin/ethtool -k eth2
Offload parameters for eth2:
rx-checksumming: on
tx-checksumming: on
scatter-gather: on
tcp segmentation offload: off

But this didn't make any difference on its own. Both wireshark and tcpdump still show packet lengths greater than the MTU.

I then played with the receive buffer sizes some more:
net.core.rmem_max = 72000
net.ipv4.tcp_rmem = 4096 9000 9000

The packet length then dropped to always below 9000. Once the default and maximum receive buffer sizes went up, so did the wireshark/tcpdump lengths.

There must be some setting that I am missing, maybe the myricom card is doing something, one of these settings perhaps: lro ?

ls /sys/module/myri10ge/
myri10ge_adapt_big_thresh myri10ge_dca myri10ge_fill_thresh myri10ge_force_nvidia_msi myri10ge_intr_coal_delay myri10ge_max_irq_loops myri10ge_napi_weight myri10ge_rss_hash myri10ge_tx_hash refcnt myri10ge_adapt_med_thresh myri10ge_deassert_wait myri10ge_flow_control myri10ge_fw_name myri10ge_lro myri10ge_max_slices myri10ge_pat_idx myri10ge_small_bytes myri10ge_vlan_csum_fixup sections myri10ge_bus myri10ge_ecrc_enable myri10ge_force_firmware myri10ge_initial_mtu myri10ge_lro_max_pkts myri10ge_msi myri10ge_reset_recover myri10ge_tso6 myri10ge_watchdog_timeout