This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello,

I know that max size of IP packet is 65535 bytes.

I wanted to see some of these larger packets in wireshark capture and started downloading some files from web, however, every single packet it captured is less than 1500 bytes long.

I tried to change views in wireshark and decode everything as IP packets, but the result was the same. I also tried running torrent download over UDP - still the same.

Why there are no packets bigger than 1500?

I am using a laptop over WiFi and capturing packets on WiFi interface.

asked 27 Jan '15, 01:54

inzbartosz's gravatar image

inzbartosz
6113
accept rate: 0%


That's because the MTU (Maximum Transmission Unit) of Ethernet is 1500, which means that no matter how large an IP packet might be is irrelevant. It has to be transported over a layer 2 medium, which in your case is Ethernet. And that limits the size to 1500 (or 9000, if you enable Jumbo Frames, but that's it).

permanent link

answered 27 Jan '15, 01:58

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Well, not Ethernet but WiFi, but the MTU is the same ;-)

(27 Jan '15, 02:02) SYN-bit ♦♦

Well, I wanted to see packet size on layer 3 or even segments on L4 which should have larger sizes, but all I see are WiFi frames... How can I change this?

(27 Jan '15, 02:06) inzbartosz

You can't change it. All you can do is force IP fragmentation, e.g. by sending ping packets with large payloads. On windows, the parameter would be "-l size" to do this. But not all pinged nodes do reply to fragmented packets like that.

(27 Jan '15, 02:09) Jasper ♦♦

@SYN-bit: true, of course, but the largest maximum limitation will always be Ethernet those days I guess, WiFi is just the last mile :-)

(27 Jan '15, 02:10) Jasper ♦♦

@Jasper: Or the first mile for outgoing packets! In which case (for UDP, ICMP, etc) the packets could have been larger if the MTU of the local layer-2 medium was larger ;-)

(27 Jan '15, 02:16) SYN-bit ♦♦
1

@SYN-bit yep, but let's not confuse anybody and keep it a secret ;-)

(27 Jan '15, 02:34) Jasper ♦♦
showing 5 of 6 show 1 more comments
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×27
×25

question asked: 27 Jan '15, 01:54

question was seen: 2,395 times

last updated: 27 Jan '15, 02:34

p​o​w​e​r​e​d by O​S​Q​A