Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
I'm learning TCP networking by analysing the uploading of a large file to a web server.
During the syn, syn/ack, ack, the server and the client agree on Maximum Segment Size = 1460. This is consistent with what I read on the net.
But from my Wireshark capture I can see that each TCP segment actually contains 2776 bytes of data.
Clearly these are two different things and I've misunderstood something.
My question is:
How/When/Where does the length of data of TCP segments get decided?
If you are referring to the Wireshark "data length" column, that is a SUM of all IP fragments of one TCP segment.
The reason why this is done is that your OS is actually sending big TCP segments to the network card and the network card does the fragmentation to the (smaller) MTU, that's why you see that you're sending 2776 bytes long frames (the same can happen on the receiving side I think). If you'd sniff directly on the wire (a switch for example) you would see only 1518/1522 bytes frames.
This is called Large Segment Offload and is a function of a network card. It can be turned off and then the OS will have to send frames to the network card which are under the MTU limit.
