4

I've been reading about maximum transmission unit (MTU) which is the size of the largest protocol data unit (PDU) that can be communicated in a single, network layer, transaction.

I'm generating a few network traffic right now and capture it in Wireshark, unfortunately I'm not sure which one is the MTU size value in PCAP file.

Please let me know how to inspect this value in Wireshark.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 8:17
7

There is nothing in the packet that will tell you what the MTU is. It's an attribute of an interface. The MTU can vary along the path from source to destination. So for example, the link from A to B might have an MTU of X, but the link from B to C, might be Y. There's no way to tell from the PCAP file.

You might be able to infer the MTU value of some link the packet traveled if you see fragmented packets. But that would be an educated guess at best.

| improve this answer | |
  • MTU is available on TCP SYN packets anyway. – Joshua Apr 10 '18 at 19:27
  • 1
    @Joshua You mean MSS, don't you? This is derived from the destination's MTU which might be the path MTU - or not. – Zac67 Apr 10 '18 at 19:58
  • @Zac67: My understanding is that intermediate routers are intended to edit it so that by the time it is received it is the path MTU. – Joshua Apr 10 '18 at 20:00
  • @Joshua I see - since routers are supposed to be L3 devices, this doesn't usually work and has been pretty much abandoned. Path MTU Discovery works by actually trying to send packets of the desired size, on IPv4 this requires the DF bit to be set. – Zac67 Apr 10 '18 at 20:25
  • 1
    @Joshua Intermediate routers are not intended to edit the MSS. But some are able to do it as a workaround for broken PMTU discovery. That technique is usually called MSS clamping. And it is a very effective way to work around networks which broke PMTU discovery one way or another. – kasperd Apr 10 '18 at 22:52
2

As Ron has nicely explained, you can't reliably observe the MTU in a packet capture. You can find a minimum value from the largest frame size you've observed (minus L2 overhead) and you can guess.

Since the MTU is a property of the IP binding to a network interface you can just ask your operating system, e.g. in Windows

netsh interface ipv4 show interfaces
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.