This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

does mtu size on capture NIC limit the size of packets you can capture?

0

I'm wondering, because I captured traffic on a network link that handles "jumbo" frames, but the capture NIC I used had the MTU set at the default 1500 value. I looked at the resulting .pcap file, and I do have frames with byte sizes exceeding 1500. So can anyone confirm that the promisc function of the NIC is not subject to the MTU set on the NIC? Or must one set the MTU size on the capture NIC to say 9000 to be able to capture jumbo frames without incident?

asked 22 May '12, 20:49

willdennis's gravatar image

willdennis
6113
accept rate: 0%


2 Answers:

2

The MTU size does not limit capturing (receiving) large packets, as it's the Maximum Transmission Unit (MTU) ;-)) There might be issues with your nic driver if we talk about jumbo frames, but that's a different problem.

Try yourself:

ifconfig eth0 mtu 500

Now capture some traffic. You will see packets > 500 bytes.

See also this question: http://ask.wireshark.org/questions/10862/working-on-jumbo-frames-with-wireshark

Regards
Kurt

answered 22 May '12, 23:03

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 23 May '12, 06:37

Sometimes it pays to remember what the acronym stands for :) Thanks, Kurt!

(23 May '12, 05:29) willdennis

2

My guess would be that the NIC implements Postel's law

answered 22 May '12, 21:57

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%