when I tested the FTP and monitored the log through wireshark, I found something very strange. since it started, the TCP segment size has been more than 30000bytes even the MSS which shared before was 1400 bytes. how the TCP send a segment to destination with this kind of big bytes. asked 21 Apr '13, 19:57  burnall |
One Answer:
TCP doesn't send it to the destination. What you're seeing is the result of the TCP segmentation offloading functionality: http://wiki.wireshark.org/CaptureSetup/Offloading It basically means that you did the capture on the PC that sent the data and you captured it in a way it was never sent. The network card will cut the large block into smaller segments, but only after you've already picked it up in Wireshark. Capture on the other PC to see that there are in fact small segments coming in. You can also tell by looking at the acknowledges - you'll get a lot more than just one for the big segment. answered 22 Apr '13, 01:02  Jasper ♦♦ edited 23 Apr '13, 12:04 |
Thank you so much, dude!
If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions.
Jasper, in link you provided there is one more offload method - TCP chimney. Did i understand correctly that TCP chimney is one of TOE realization where TCP offloaded from CPU only after connection is established - during transfer, and then passed back to CPU to finish connection?
yes, TCP chimney means that the network card takes over segmentation and CRC calculation from the CPU.