Wireshark · Wireshark-users: Re: [Wireshark-users] Windows 7 Ignores TCP MSS?

[Hansang Bae <for_list_hbae@xxxxxxxxxx>]

On 3/23/2011 7:14 PM, Robinson, Eric wrote:

I just did a capture of a file transfer from a Windows 7 computer to a Linux FTP server. I can see the Windows client reporting its MSS at 1460. Then I see the FTP server reporting its MSS at 1460. But when the transfer starts, the client sends 2896-byte packets!

 

Following are the settings on the Windows client box.

 

C:\>netsh interface ipv4 show subinterface

    MTU  MediaSenseState   Bytes In  Bytes Out  Interface
------  ---------------  ---------  ---------  -------------
4294967295                1          0      22655  Loopback Pseudo-Interface 1
  1500                1  271689236  1374564858  Local Area Connection

 

C:\>netsh int tcp show global

TCP Global Parameters
----------------------------------------------
Receive-Side Scaling State          : enabled
Chimney Offload State               : disabled
NetDMA State                        : enabled
Direct Cache Acess (DCA)            : disabled
Receive Window Auto-Tuning Level    : disabled
Add-On Congestion Control Provider  : ctcp
ECN Capability                      : disabled
RFC 1323 Timestamps                 : disabled

It's likely that the NIC has hardware TCP offloading enabled and you're capturing it before the NIC chops it up to 1460.   If you capture the traffic from the network, you'll likely see the 1460 TCP length packets.