I was asked to do a pcap for an applicaiton that is using jumbo frames over a fiber connection. Are there any special settings - or trap doors - that I need to be aware of? All my captures up to date have been with MTU 1500 and down. Thanks asked 09 May '12, 20:30  EricKnaus edited 10 May '12, 12:07  helloworld |
One Answer:
I don't think there will be any trap doors, Wireshark should be able to handle jumbo frames just fine. If I were you I'd just do a capture and see what I get :-) answered 10 May '12, 01:40  Jasper ♦♦ showing 5 of 8 show 3 more comments |
According to a recent post, Wireshark can't handle jumbograms above 64kB.
Just a second, we're talking jumbo frames not jumbograms. The first are "oversized" ethernet frames with an MTU of 9000, while jumbograms are IPv6 specific packets that can be much larger than 64k. I doubt EricKnaus was asking about those - as far as I read it he really meant run-of-the-mill ethernet jumbo frames.
Ok, I see. I'm no expert at "jumbo-anything" ...but I'm pretty good at skimming posts ;)
The question is titled "jumbo frames", the body indicates "jumbo packets", and it's tagged as "jumbograms". I don't know what the target is.
True, the wording is a bit inconsistent in the question. But I think we can rule out IPv6 jumbograms at the moment since I doubt anyone is using them for anything beyond some kind of IPv6 lab experiments :-)
I see only one "trap door". There are switches which allow configuration of jumbo frames:
So, just ensure, you enabled jumbo frames on your mirroring/monitoring port, otherwise you might not see some frames. Please consult your switch manual.
Yes, I was not specific - it's jumbo frames. Kurt's comments helps too. Btw, in what sort of environment would I run into jumbograms? and then how would I capture/read them? I see IPv6 all over the place in many PCAP's but have not paid that much attention to them as they usually constitute less than 6% of the traffic and are usually router or W7 machines that use a v4 address anyway.
At the moment I doubt you'll see Jumbograms anywhere except in some mad scientists laboratories where they're fiddling around with the jumbogram option that IPv6 has :-) The problem is that there is still the ethernet MTU at 1500 or 9000 bytes, so unless you're running Jumbograms on a different medium with larger frame sizes you'll have to fragment them. And that is not really efficient, so I doubt we'll see much use of Jumbograms anytime soon.
Well, there actually was 1 trap door. The laptops we were using would not see anything over 1500MTU! We were able to ping to the servers with jumbo frames and see them that way but were were hoping to do this "in line". The setting that we played with on our servers but not on the units we were trying to capture with (W7, 64bit, 10/100/1000) - 2 year old Dells. Can I use this as an excuse to get something new and cool when I explain this to my wife? ... er for work ofcourse!