TCP much larger than 1460 bytes?

retag add tags

I do not understand, why a see a lot of packets much larger than 1460 bytes. On different Win10 devices in my LAN. The network adapters on the devices are set to MTU 1500, switch has MTU 1518. No device in my LAN has MTU more than 1518 bytes. The MSS in the SYN-packets show 1460 bytes. Why are there packets with much more than 1460 bytes?

14021 09:51:25,644834    0.000093       192.168.1.4           104.xx.yyy.zz         TCP      11254  50004 → 443 [ACK] Seq=34207 Ack=3156 Win=4122 Len=11200 [TCP segment of a reassembled PDU]

Modern NICs and their drivers can handle many networking tasks and among them is segmentation offloading and this leads to the capture library recording these larger packets.

See the Wiki page on offloading for more info.

Incidentally yet another reason to not perform captures on the host systems themselves.

23.8k

grahamb

answered 2019-10-12 09:34:58 +0000

edit flag offensive 0 remove flag delete link

Comments

Thanks for explanation.

kuchenmann (2019-10-12 12:18:38 +0000) edit

If an answer has solve your issue, for the benefit of others with the same question, please accept the answer by clicking the checkmark to the left of the answer.

grahamb (2019-10-12 13:17:07 +0000) edit

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

TCP much larger than 1460 bytes? edit

Comments

1 Answer

Comments