Working with a network entirely consisting of Cisco router/switch, two devices (server and client) are talking to each other across a network, about 5 hops of routers including a nexus 7k.
Server packet capture from directly on the hardware (not SPAN) is showing the TCP segment length above the MTU (1500) and the DF bit set
Client packet capture is from SPAN'd port is showing those same segments (as matched using the IP-ID value and absolute time) but they appear fragmented, still showing the DF bit but not the MF or any other sign of being an IP fragment.
The data lengths of the two packets (1460 + 648 byte) received by the client add up exactly to the length of the one packet sent by the server (2108 byte)
Any ideas on what would be responsible for chopping up the packet and not following fragmentation standards for ipv4?