Wireshark · Wireshark-users: Re: [Wireshark-users] Windows 7 Ignores TCP MSS?

[Andrew Hood <ajhood@xxxxxxxxx>]

Robinson, Eric wrote:
>  >  It's likely that the NIC has hardware TCP offloading enabled and
> you're  
> 
>> capturing it before the NIC chops it up to 1460.   If you capture the
> 
> traffic  
> 
>>from the network, you'll likely see the 1460 TCP length packets.
> 
>  
> If the NIC has offloading enabled, I guess the stack knows this and
> sends it bigger frames, knowing it will packetize them smaller? Because
> I went into the adapter properties and turned off all the offloading
> features, and now it is being reported as expected in WireShark. So I
> guess when the NIC's offload capabilities are disabled, the stack
> detects this and only sends it frames that are appropriate for the MTU?

You will also find if TCP Chimney is enabled you will only see the
session setup and teardown packets (SYN/FIN/RST) for TCP connections.

Andrew
-- 
There's no point in being grown up if you can't be childish sometimes.
                -- Dr. Who