My host machine is ubuntu and guest machine is windows 7. I'm generating traffic on windows 7 and capturing its traffic in the middle on ubuntu with wireshark. Both host and guest machines' MTU is 1500 bytes, but i see no packet with size more than 1430 bytes in wireshark. 1430 bytes is for (application data + tcp and ip headers) and the size on wire is 1444 bytes. My question is that why the packets don't have the size of 1500 considering (application data + tcp and ip headers) ? asked 20 Jan '16, 14:51  Amins |
One Answer:
If the SYN-ACK packet has 1390 it means that the Server supports only an MTU of 1390 + 20 (standard TCP header size) + 20 (standard IPv4 header size) = 1430. So even if your machine supports 1460 (= MTU 1500) it will not utilize it, because it knows that the server cannot receive packets of that size. And the server will not send anything greater than 1430 because it's MTU doesn't allow it. While the MSS in the SYN packets is not really a negotiation both nodes are wise to use the lower number as a maximum size for their segments to avoid "fragmentation needed" problems. So if you wonder why the server uses an MTU of 1430 you need to check it's stack/interface setting. Somewhere it must have been configured that way. answered 21 Jan '16, 01:15  Jasper ♦♦ edited 21 Jan '16, 01:18 1 Jaspers answer has inspired me to write the following article about the mtu and the mss: (30 Jan '16, 14:34) Christian_R |
What's the MSS in the TCP SYN packets? Is one of them less than 1460?
The MSS in the syn packet is 1460 bytes but in the syn-ack packet, the MSS is 1390 bytes and i also see the size of 1390 bytes for layer application in my packets.