Home page logo

wireshark logo Wireshark mailing list archives

Re: How can a packet size be greater than the NIC's MTU?
From: Mohamed Lrhazi <lrhazi () gmail com>
Date: Tue, 3 Dec 2013 23:32:03 -0500

On Tue, Dec 3, 2013 at 11:16 PM, Shawn Carroll <shawnthomascarroll () yahoo com

IP fragmentation

I am not sure this is about IP fragmentation... well, maybe, but tcpdump
-vvvv -r my.pcap.file still shows just one packet with that big size... and
in wireshark, with "Reassemble IPv4 fragmented datagrams" disabled, I still
see a single packet with that bigger than Ethernet MTU size.

So, if the packet I am seeing is actually several IP datagrams... how can I
prove it to myself, but getting wireshark or other tool, to show me the
unique datagrams and their respective sizes and other L2 details?

I'd like to be able to track the problem to: See, this datagram left this
NIC and never made it to this other NIC, on this other device.... while
these smaller one did.

I can share the pcap.... if need be. What's this lists best way of sharing
a pcap file? The pcaps I took were with "tcpdump -s0 -w /tmp/file.pcap"

Thanks a lot,
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]