Actually, I have two related questions.
I’m capturing filtered network traffic by libpcap on Debian. Then I need to replay this traffic on Win2k3 server. Sometimes I capture packets, both TCP and UDP, much larger than 1500 bytes (default MTU size for Ethernet). E.g., 2000+ bytes. I did no specific changes to MTU size on that Linux. So question #1:
What’s the reason for these packets much larger than default MTU? Jumbo frames? This Wikipedia article states that “network interface cards capable of jumbo frames require explicit configuration to use jumbo frames”, but I’m not aware about any such configuration. Also ifconfig shows me “MTU:1500”. Can it be somehow related with “interrupt-combining” technique (or “interrupt coalescing” as in this article)? Can I supress such packets?
Then, question #2:
How can I send such packets by pcap_sendpacket on Windows? I receive error message “send error: PacketSendPacket failed” only for packets larger than 1500 bytes. Seems I cannot use jumbo frames because I’m sending data to directly connected custom “net tap” like pci card and I’m not sure I can configure its NIC. What else? Should I fragment these packets according to the protocol rules?
EDIT:
Checked fragmentation by NIC as Guy Harris suggested:
~# ethtool -k eth0
Offload parameters for eth0:
rx-checksumming: on
tx-checksumming: on
scatter-gather: on
tcp-segmentation-offload: off
udp-fragmentation-offload: off
generic-segmentation-offload: off
generic-receive-offload: off
large-receive-offload: off
ntuple-filters: off
receive-hashing: off
The same for eth1 and br0 – network bridge between eth0 and eth1 which I’m sniffing.
And I still receive large UDP packets.
¿Are you using the wireshark to capture?
It’s important beacause by default wireshark reassemble fragmented ip datagrams (and stores them in a pcap file as reassembled MTU-higger single packages without fragmentation).
To disable:
Edit->preferences->Protocols->ipV4-> and uncheck “Reassemble fragmented IPv4 datagrams”.