This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Why I cannot see any packets larger than 1500 bytes in wireshark?

0

Hello,

I know that max size of IP packet is 65535 bytes.

I wanted to see some of these larger packets in wireshark capture and started downloading some files from web, however, every single packet it captured is less than 1500 bytes long.

I tried to change views in wireshark and decode everything as IP packets, but the result was the same. I also tried running torrent download over UDP - still the same.

Why there are no packets bigger than 1500?

I am using a laptop over WiFi and capturing packets on WiFi interface.

asked 27 Jan '15, 01:54

inzbartosz's gravatar image

inzbartosz
6113
accept rate: 0%


One Answer:

1

That's because the MTU (Maximum Transmission Unit) of Ethernet is 1500, which means that no matter how large an IP packet might be is irrelevant. It has to be transported over a layer 2 medium, which in your case is Ethernet. And that limits the size to 1500 (or 9000, if you enable Jumbo Frames, but that's it).

answered 27 Jan '15, 01:58

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Well, not Ethernet but WiFi, but the MTU is the same ;-)

(27 Jan '15, 02:02) SYN-bit ♦♦

Well, I wanted to see packet size on layer 3 or even segments on L4 which should have larger sizes, but all I see are WiFi frames... How can I change this?

(27 Jan '15, 02:06) inzbartosz

You can't change it. All you can do is force IP fragmentation, e.g. by sending ping packets with large payloads. On windows, the parameter would be "-l size" to do this. But not all pinged nodes do reply to fragmented packets like that.

(27 Jan '15, 02:09) Jasper ♦♦

@SYN-bit: true, of course, but the largest maximum limitation will always be Ethernet those days I guess, WiFi is just the last mile :-)

(27 Jan '15, 02:10) Jasper ♦♦

@Jasper: Or the first mile for outgoing packets! In which case (for UDP, ICMP, etc) the packets could have been larger if the MTU of the local layer-2 medium was larger ;-)

(27 Jan '15, 02:16) SYN-bit ♦♦
1

@SYN-bit yep, but let's not confuse anybody and keep it a secret ;-)

(27 Jan '15, 02:34) Jasper ♦♦
showing 5 of 6 show 1 more comments