Hello, I know that max size of IP packet is 65535 bytes. I wanted to see some of these larger packets in wireshark capture and started downloading some files from web, however, every single packet it captured is less than 1500 bytes long. I tried to change views in wireshark and decode everything as IP packets, but the result was the same. I also tried running torrent download over UDP - still the same. Why there are no packets bigger than 1500? I am using a laptop over WiFi and capturing packets on WiFi interface. asked 27 Jan '15, 01:54  inzbartosz |
One Answer:
That's because the MTU (Maximum Transmission Unit) of Ethernet is 1500, which means that no matter how large an IP packet might be is irrelevant. It has to be transported over a layer 2 medium, which in your case is Ethernet. And that limits the size to 1500 (or 9000, if you enable Jumbo Frames, but that's it). answered 27 Jan '15, 01:58  Jasper ♦♦ showing 5 of 6 show 1 more comments |
Well, not Ethernet but WiFi, but the MTU is the same ;-)
Well, I wanted to see packet size on layer 3 or even segments on L4 which should have larger sizes, but all I see are WiFi frames... How can I change this?
You can't change it. All you can do is force IP fragmentation, e.g. by sending ping packets with large payloads. On windows, the parameter would be "-l size" to do this. But not all pinged nodes do reply to fragmented packets like that.
@SYN-bit: true, of course, but the largest maximum limitation will always be Ethernet those days I guess, WiFi is just the last mile :-)
@Jasper: Or the first mile for outgoing packets! In which case (for UDP, ICMP, etc) the packets could have been larger if the MTU of the local layer-2 medium was larger ;-)
@SYN-bit yep, but let's not confuse anybody and keep it a secret ;-)