First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

Impossibly large frames in capture

  • retag add tags

Hello,

I have a packet capture that I've taken from SPANning a Cisco Nexus switchport. The switchport is connected to an esxi host that is running VSAN. In the capture I am seeing impossibly large frame sizes:

Frame 17927: 31926 bytes on wire (255408 bits), 31926 bytes captured (255408 bits)

I have confirmed that the MTU on the vswitch, vmk, physical nic, and nexus switch are all 1500. Additionally, the MSS in the initial three-way handshake of every single handshake in my capture is 1460. Regardless, the jumbo frames counters on the Nexuses are incrementing fairly regularly.

I've read forum posts of other people who've experienced this, but in all of those cases it seemed they were capturing at the source and the large frames were a byproduct of segment offloading or some other feature. I'm not capturing at the source, I'm capturing at an intermediary switch that definitely has a MTU of 1500. How could my capture have frames in it that would be impossible even if I was running jumbo frames?

pl45ok67's avatar
1
pl45ok67
asked 2019-05-02 18:58:09 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

1

Have you checked the offloading settings of the capture system? I have had this happen to me when capturing on a linux box with Large Receive Offloading enabled. The NIC will combine the packets before sending it to the OS. It's best to turn off all offloading features of the NIC on the capturing system.

SYN-bit's avatar
18.5k
SYN-bit
answered 2019-05-02 19:30:46 +0000
edit flag offensive 0 remove flag delete link
more

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer