I'm capturing on a linux server using tcpdump
tcpdump -i eth2 -s 1600 -w file.out
When reviewing the file.out in Wireshark I see many frames that are huge (larger than 9K bytes). These ethernet frames aren't valid on the network. I'm not using jumbo frames either and they are larger than 9K.
Our theory is the huge ethernet frames are not "real" but are the OS transferring to the 10Gbe nic driver.
Any thoughts or experience with these ?
asked 01 Mar '12, 11:09
Correct: you're probably looking at Segmentation Offload.
[Update] Don't forget to drop by and Accept this answer if it answered your question.
answered 01 Mar '12, 11:47
edited 09 Mar '12, 06:58