This is our old Q&A Site. Please post any new questions and answers at

Hi, sorry for the "beginners" question :)

I´ve a appliance that works as a transparent bridge. I wanted to know, if i can use wireshark in order to know which is the MTU value that is received by the bridge (i´ve been having issues in regards http latency, and i want to know if this could be network related.

I´m using this filter: tcp.flags.syn== 1 and tcp.flags.ack==1 and tcp.port==80

Thanks in advance, RPLF

asked 22 May '12, 02:02

ruiplf's gravatar image

accept rate: 0%

a bridge should not modify the packet size (or do any fragmentation). If you want to know if the bridge is actually modifying the packets, you should sniff in front of the bridge and behind it, then compare the two captures files. Sniffing only at one "collection point" (client or server) makes it hard to detect any modification.

If you compare the capture files look at the packet size. You can do this, by adding a column in the packet list view.

Edit -> Preferences -> Columns -> Add -> Field type: Packet length (bytes).


permanent link

answered 22 May '12, 03:27

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
accept rate: 15%

edited 22 May '12, 03:30

I'm not sure sniffing traffic is the best way to test for MTU size... I'd use a tool like 'tracepath' to verify the path MTU. See:

HTH, Will

permanent link

answered 23 May '12, 05:59

willdennis's gravatar image

accept rate: 0%

a bridge/switch is a layer 2 device and would not answer to PMTU probes.

(23 May '12, 06:38) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 22 May '12, 02:02

question was seen: 41,759 times

last updated: 23 May '12, 06:38

p​o​w​e​r​e​d by O​S​Q​A