Learn F5 Technologies, Get Answers & Share Community Solutions Join DevCentral

Filter by:
  • Solution
  • Technology
Answers

length of the packet as 1618 in wireshark

Hello All, I'm troubleshooting application connectivity issue on LB. When I tried telnet to the application VIP on LB it is working whereas when I tried to post the data using HTTP is not working.

I did a packet capture to do the troubleshooting on the LB and a weird thing I noticed is for some reasons the length of the packet is 1618 on the wire.

As far I know the MTU is 1500 bytes.

whether the length of the packet 1618 bytes on wire will create any issue.

Regards, Thiyagu

0
Rate this Question

Answers to this Question

placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Hi Thiyagu,

If your network supports Jumbo MTU (above 1500 bytes),then 1618 bytes will be normal. If your network does not support Jumbo MTU, you will have some level of fragmentation which might have an impact on performance.

Regards.

0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Hi,

This is expected behaviour when you use Wireshark from an endpoint, and the client is running TCP segmentation offload (TSO). TSO offloads the dividing of data from the CPU to the NIC.

Basically, this means that Wireshark picks up the frames, before they go out on a network wire, and you will see the length of each packet before the data is divided.

There are a lot of articles on this, if you want to read more.

Just do a google search for the following: Wireshark shows network packet larger than MTU

Best regards,

Morten

0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Hi Thiyagu,

As far I know the MTU is 1500 bytes. whether the length of the packet 1618 bytes on wire will create any issue.

Its absolute normal that WireShark captures ethernet frames bigger than your maximum ethernet MTU.

The reason is, that the MTU defines just the maximum payload size of an Ethernet Frame without including any ethernet headers/trailers and optionally the overhead of underlying tunnel/trunking protocols (e.g 802.1Q Tags, MPLS, IS-IS, etc.).

Are you absolute sure about having a 1618byte packet size and not just 1518bytes? I'm asking because it would mean that you're running multiple tunnel/trunking protocols at the same time or that you've deployed jumbo frames (aka. MTU larger than 1500). A packet size of exactly 1518 bytes would be the minimum size to transfer a full MTU.

Cheers, Kai

0