Don't fragment set, still being fragmented

Question

Working with a network entirely consisting of Cisco router/switch, two devices (server and client) are talking to each other across a network, about 5 hops of routers including a nexus 7k.

Server packet capture from directly on the hardware (not SPAN) is showing the TCP segment length above the MTU (1500) and the DF bit set

Client packet capture is from SPAN'd port is showing those same segments (as matched using the IP-ID value and absolute time) but they appear fragmented, still showing the DF bit but not the MF or any other sign of being an IP fragment.

The data lengths of the two packets (1460 + 648 byte) received by the client add up exactly to the length of the one packet sent by the server (2108 byte)

Any ideas on what would be responsible for chopping up the packet and not following fragmentation standards for ipv4?

Answer 1

This is, as Ricky Beam indicates, almost certainly TCP segmentation being done by the NIC. If you're capturing traffic on the server, capturing packets being sent by the server, and TCP segmentation offloading is being done, the server's operating system will hand packets bigger than the network's MTU to the NIC (with the expectation that the NIC will turn them into multiple IP packets) and to the packet capture mechanism and thus to the packet capture program, so it will appear as if a packet bigger than the network's MTU is being transmitted on that network - for example, Ethernet packets larger than 1514 bytes.