ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: [Wireshark-users] ESX guest sending frames larger than MTU, yet negotiated MSS i

From: "Manassypov, Igor" <IManassypov@xxxxxx>
Date: Thu, 6 Oct 2011 12:27:54 -0400
Title: ESX guest sending frames larger than MTU, yet negotiated MSS is 1460

Hi,

I am troubleshooting communication issues between windows ESX guest communicating to microsoft App-V server via RTSP (tcp 514) protocol.

The client and server reside on different subnets with cisco router in between. Configured MTU is 1500 all across.

Occasionally I get an ICMP destination unreachable, fragmentation needed response kicked back at the client. Doing a concurrent capture at client and server interfaces, I noticed that occasionally frames with sizes much greater than MTU ( > 2000 ) arrive at the server with DF bit set, which naturally get dropped. Each TCP stream negotiaties MSS of 1460.

If someone could help me understand how this behavior is possible, and why would the packet not get dropped by the transit router? I've hard-coded windows client MTU to 1500, and yet I am seeing these frames being put on wire.

Here is the sample relevant output from the capture:


Maximum segment size: 1460 bytes

And yet within the same connection stream down the road:

Frame 316 (2974 bytes on wire, 96 bytes captured)


The MAC address of the frame received at the server is the mac address of the transit cisco router as expected.


Thanks!


#############################################
This communication is confidential and may be 
privileged.  If you received it in error, please destroy 
without copying and advise the sender.

By submitting personal information to CI Investments, 
you agree to the collection, use and disclosure of 
such personal information for the purposes described 
in our Privacy Policy available at www.ci.com.


Cette communication est confidentielle et pourrait être 
privilégiée. Si vous la recevez par erreur, veuillez 
l'éliminer sans en faire une copie et aviser l'expéditeur.

Lorsque vous soumettez des renseignements 
personnels à Placements CI, vous nous permettez de 
conserver, utiliser et divulguer ces renseignements 
personnels aux fins décrites dans nos Principes 
directeurs en matière de protection des renseignements personnels 
qui sont disponibles au www.ci.com.

###############################################