| Main Archive Page > Month Archives > wireshark-users archives |
[Wireshark-users] Bytes on wire/bytes captured for TCP traffic is larger than MTU
From: Mark Ryden <markryde_at_nospam>Date: Sat Oct 09 2010 - 14:13:34 GMT
To: wireshark-users@wireshark.org
Hello,
I am sniffing with wireshark TCP iperf traffic on a machine where the
NIC has an ordinary NIC.
The MTU of the NIC on the client and the server is the default value (1500).
I see in the sniff that some of the frames have (2962 bytes on
wire,2962 bytes captured)
and also that the ip header Total length is 2948. My question is: how can it be
that I am getting size of a packet which is almost twice the size of MTU ?
AFAIK, you cannot receive/send packets larger than the MTU without
fragmentation,
and what I see does not show fragmentation.
Rgs,
Mark Ryden
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@wireshark.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@wireshark.org?subject=unsubscribe