This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

FTP Problem

0

Hi ,

I have a problem witch my FTP server. The problem are packet lost. I captured traffic and I saw strange problem with ftp-data length value.

Server and client have set MTU = 1460 but client sent data to server witch MTU 1590 bytes.

192.168.2.14 192.168.2.2 FTP-DATA 1078 FTP Data: 1024 bytes

192.168.2.14 192.168.2.2 FTP-DATA 1590 FTP Data: 1536 bytes

192.168.2.2 192.168.2.14 TCP 60 62305 > 62057 [ACK] Seq=1 Ack=105909 Win=28288 Len=0

Why client sent data to server with mtu 1590 instead 1460 bytes ? Where is a problem ?

asked 18 Oct '11, 12:08

Robert's gravatar image

Robert
1112
accept rate: 0%


One Answer:

2

As far as I read your quote it doesn't say "MTU" anywhere, just that FTP sent 1536 bytes (which would be the TCP payload size, not the MTU).

There are a couple of reasons why you're seeing packets with that kind of "large" payload, for example if you're capturing your own, outgoing traffic. Your network card is probably doing something called "large send offloading", meaning that it slices the data into valid chunks before sending it out, but by then Wireshark has already captured it, fooling you :-)

Try to capture the same data on the other end, and you'll see that the packets arrive with valid sizes.

answered 18 Oct '11, 12:17

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

yes , you have right :) I checked it and tcp payload size is 1460 bytes. I must remember about "large send offloading"

thank you Robert

(18 Oct '11, 12:32) Robert