Wireshark · Wireshark-users: Re: [Wireshark-users] FW: Oversized packets

[Graham Bloice <graham.bloice@xxxxxxxxxxxxx>]

On 07/04/2010 10:53, Tyrone Clarke wrote:

It appears that I sent this to the wrong mailing list, so I’m resending it to this one.

 

Regards

 

<SNIP>

Hi

 

I’m experiencing a problem with oversized packets, in a Wireshark capture.

 

I’ve had a look for previous postings and it looks like this problem was resolved back in 2007.

 

The question that I have is; is what I’m seeing in the capture file a problem with Wireshark or is it a problem with the NIC drivers?

 

I’ve run Wireshark on two different servers, admittedly the same model; however I’m seeing the same problem on both servers.

 

The packets arrive at the destination workstation with the proper segmentation, which in turn generates the appropriate acknowledgement, which accounts for the lost segment errors that appear in the capture.

 

We are building a new application, and are having some performance issues, so it would be good to know if the errors that we are seeing in Wiresahark could relate to the problem?

 

I hope its OK, but I’m attaching a screen capture of the problem.

 

 

Oh as for the hardware, briefly its:-

 

OS:                  Windows Server 2008 R2 Standard (this is the 64bit version)

Memory            4GB

Platform:          Dell PowerEdge M610

NIC:                  Broadcom BCM5709S NetXtreme II GigE

 

Wireshark version:-

 

wireshark-win64-1.2.7.exe

 

Regards

Your network stack is off-loading portions of the work required to the hardware in the NIC.  Try setting the options to allow for this:

Edit | Preferences | Expand Protocols and find IP | Check "Support packet-capture from IP TSO-enabled hardware".

-- 
Regards,

Graham Bloice