Wireshark-users: Re: [Wireshark-users] How can a packet size be greater than the NIC's MTU?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Mohamed Lrhazi <lrhazi@xxxxxxxxx>
Date: Tue, 3 Dec 2013 23:32:03 -0500

On Tue, Dec 3, 2013 at 11:16 PM, Shawn Carroll <shawnthomascarroll@xxxxxxxxx> wrote:
IP fragmentation


I am not sure this is about IP fragmentation... well, maybe, but tcpdump -vvvv -r my.pcap.file still shows just one packet with that big size... and in wireshark, with "Reassemble IPv4 fragmented datagrams" disabled, I still see a single packet with that bigger than Ethernet MTU size.

So, if the packet I am seeing is actually several IP datagrams... how can I prove it to myself, but getting wireshark or other tool, to show me the unique datagrams and their respective sizes and other L2 details?

I'd like to be able to track the problem to: See, this datagram left this NIC and never made it to this other NIC, on this other device.... while these smaller one did.

I can share the pcap.... if need be. What's this lists best way of sharing a pcap file? The pcaps I took were with "tcpdump -s0 -w /tmp/file.pcap"

Thanks a lot,
Mohamed.