This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Wireshark Win 7 x64 not showing incoming frames over 1518 bytes size despite of big MTU

0

I have changed the MTU to 1600 and do several tests with different setups. I get to capture and see in Wireshark "big" outgoing frames (i.e. 1600 bytes) but fail to see incoming "big" frames, despite I am totally certain those frames get the network adapter.

Any help would be very much appreciated.

asked 11 Apr '13, 02:25

JAVIER's gravatar image

JAVIER
5114
accept rate: 0%

edited 11 Apr '13, 07:27

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237

What is your NIC brand and modell?

(11 Apr '13, 03:37) Kurt Knochner ♦

Intel 82577LC Gigabit Network Connection

(11 Apr '13, 04:18) JAVIER

2 Answers:

2

Intel 82577LC Gigabit Network Connection

Can you please follow the instructions of a guy who also had problems with same NIC and with Jumbo frames.

http://forum.notebookreview.com/sony/565138-vpc-z1-jumbo-frames.html

First: Please change (or check) the registry value mentioned in the post (then reboot).
Second: Don't use a docking station (if you do now)! That solved the problem for the other guy.

Regards
Kurt

answered 11 Apr '13, 05:49

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Eureka!

Just follow the instructions and finally get Jumbo Frames incoming !!

To summarize my conclusions and experience:

1) By changing mtu at Win7 "netsh" context level ("netsh int ipv4 set subint <interface name=""> mtu=xxxx") I got just only Jumbo Frames outgoing capability, the laptop was able to send large frames, but not large incoming frames were displayed.

2) By changing the NIC Jumbo Frames capability at Win 7registry level (according to your instructions), the laptop finally got Jumbo frames incoming capability, I just got to display incoming large frames!. Notice that "*JumboPacket" entry was not present and I had to create it in the registry.

Thanks a lot

Kind regards

(11 Apr '13, 06:42) JAVIER

Thanks a lot

You're welcome.

Hint: If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions.

(11 Apr '13, 07:03) Kurt Knochner ♦

0

Where are you capturing? On the device that is sending the packets? Have you disabled offloading capabilities in your NIC? Otherwise you might just see large chunks of data that gets segmented on the card.

Also, your switch may drop "oversized" packets unless it is configured to work with Jumbo frames, which means that your packets may leave your PC but they will not get to the destination, and there will not be any reply. Even IF there would be a reply, the switch could drop the frames again for being "oversized".

answered 11 Apr '13, 02:30

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Thanks a lot Jasper for your promptly answer.

I have tried lot of setups and different options.

In order to discard some dropping in the intermediate path, finally I tested two Win7 1600 mtu laptops directly connected, with the same results. Both laptops send "big frames" and display it perfectly in Wireshark (I am certain they send big frames as I got to trace them in a intermediate router in a different setup), but fail to ¿capture? and display in Wireshark incoming big frames that get their network adapters.

I have disable all offloading related options in NIC capabilites with the same result.

(11 Apr '13, 03:27) JAVIER