Wireshark shows network packet larger than MTU

While working on my thesis I came across a weird problem, wireshark was showing packet size more than the MTU. One of the possible reason can be underlying network supports jumbo frames. But it wasn’t so in my case. 

After some googling I found the cause, Large segmentation offload (LSO) performed by NIC. LSO technique  increases the outbound throughput of high-bandwidth networks by offloading packet processing time from CPU to Network Interface Tag (NIC). When LSO is applied to TCP, it is called TCP Segmentation Offload (TSO). When LSO is applied on TCP, it is called as TCP Segmentation Offload (TSO).

The working of TSO can be explained with the help of an example. Let a unit of 65,536 bytes is to be transmitted by the host device. Assuming MTU of 1500 bytes, this data will be divided into 46 segments of 1448 bytes each before it is transmitted over to network through the NIC. Process of dividing the data into segments before sending it over the network is handed over to NIC instead of CPU. NIC will break down the data into smaller segments, and add corresponding TCP, IP and data link layer protocol headers. This significantly reduces the work done by the CPU. Large Receive Offload (LRO) is a similar technique to LSO, but applied for incoming traffic. 

ethtool -k <interface> shows the status of  LSO and LRO.  

ethtool -K <interface> tso off and ethtool -K <interface> gso off  turns off the segmentation offload and now you can see packet size of <= MTU in wireshark. 


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s