Forum Discussion

Thiyagu_163984's avatar
Thiyagu_163984
Icon for Nimbostratus rankNimbostratus
Nov 07, 2017

length of the packet as 1618 in wireshark

Hello All, I'm troubleshooting application connectivity issue on LB. When I tried telnet to the application VIP on LB it is working whereas when I tried to post the data using HTTP is not working.

 

I did a packet capture to do the troubleshooting on the LB and a weird thing I noticed is for some reasons the length of the packet is 1618 on the wire.

 

As far I know the MTU is 1500 bytes.

 

whether the length of the packet 1618 bytes on wire will create any issue.

 

Regards, Thiyagu

 

application delivery
BIG-IP

3 Replies

Sort By
  • eben's avatar
    eben
    Icon for Nimbostratus rankNimbostratus
    Nov 07, 2017

    Hi Thiyagu,

     

    If your network supports Jumbo MTU (above 1500 bytes),then 1618 bytes will be normal. If your network does not support Jumbo MTU, you will have some level of fragmentation which might have an impact on performance.

     

    Regards.

     

  • Morten_Marstran's avatar
    Morten_Marstran
    Icon for Nimbostratus rankNimbostratus
    Nov 07, 2017

    Hi,

     

    This is expected behaviour when you use Wireshark from an endpoint, and the client is running TCP segmentation offload (TSO). TSO offloads the dividing of data from the CPU to the NIC.

     

    Basically, this means that Wireshark picks up the frames, before they go out on a network wire, and you will see the length of each packet before the data is divided.

     

    There are a lot of articles on this, if you want to read more.

     

    Just do a google search for the following: Wireshark shows network packet larger than MTU

     

    Best regards,

     

    Morten

     

  • Kai_Wilke's avatar
    Kai_Wilke
    Icon for MVP rankMVP
    Nov 07, 2017

    Hi Thiyagu,

     

    As far I know the MTU is 1500 bytes. whether the length of the packet 1618 bytes on wire will create any issue.

     

    Its absolute normal that WireShark captures ethernet frames bigger than your maximum ethernet MTU.

     

    The reason is, that the MTU defines just the maximum payload size of an Ethernet Frame without including any ethernet headers/trailers and optionally the overhead of underlying tunnel/trunking protocols (e.g 802.1Q Tags, MPLS, IS-IS, etc.).

     

    Are you absolute sure about having a 1618byte packet size and not just 1518bytes? I'm asking because it would mean that you're running multiple tunnel/trunking protocols at the same time or that you've deployed jumbo frames (aka. MTU larger than 1500). A packet size of exactly 1518 bytes would be the minimum size to transfer a full MTU.

     

    Cheers, Kai