Working with a network entirely consisting of Cisco router/switch, two devices (server and client) are talking to each other across a network, about 5 hops of routers including a nexus 7k.

Server packet capture from directly on the hardware (not SPAN) is showing the TCP segment length above the MTU (1500) and the DF bit set

Client packet capture is from SPAN'd port is showing those same segments (as matched using the IP-ID value and absolute time) but they appear fragmented, still showing the DF bit but not the MF or any other sign of being an IP fragment.

The data lengths of the two packets (1460 + 648 byte) received by the client add up exactly to the length of the one packet sent by the server (2108 byte)

Any ideas on what would be responsible for chopping up the packet and not following fragmentation standards for ipv4?

  • 1
    Its not uncommon for certain firewalls to ignore and even clear the Don't Fragment bit for transient traffic. (I wouldn't quite call it common though). Either way, it might help if you provide the packet captures so we can help analyze.
    – Eddie
    Nov 18, 2014 at 20:31
  • 3
    This sounds like tcp segment offloading to the NIC. Capture packets from the network, not from the host. From the host, you cannot see what the driver/nic is doing.
    – Ricky
    Nov 18, 2014 at 21:33

1 Answer 1


This is, as Ricky Beam indicates, almost certainly TCP segmentation being done by the NIC. If you're capturing traffic on the server, capturing packets being sent by the server, and TCP segmentation offloading is being done, the server's operating system will hand packets bigger than the network's MTU to the NIC (with the expectation that the NIC will turn them into multiple IP packets) and to the packet capture mechanism and thus to the packet capture program, so it will appear as if a packet bigger than the network's MTU is being transmitted on that network - for example, Ethernet packets larger than 1514 bytes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.