This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

10gbe huge frames seen in captures

0

I'm capturing on a linux server using tcpdump

tcpdump -i eth2 -s 1600 -w file.out

When reviewing the file.out in Wireshark I see many frames that are huge (larger than 9K bytes). These ethernet frames aren't valid on the network. I'm not using jumbo frames either and they are larger than 9K.

Our theory is the huge ethernet frames are not "real" but are the OS transferring to the 10Gbe nic driver.

Any thoughts or experience with these ?

thanks Tim

asked 01 Mar '12, 11:09

timc's gravatar image

timc
1111
accept rate: 0%


One Answer:

0

Correct: you're probably looking at Segmentation Offload.

[Update] Don't forget to drop by and Accept this answer if it answered your question.

answered 01 Mar '12, 11:47

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k572
accept rate: 27%

edited 09 Mar '12, 06:58