7

I've been reading about maximum transmission unit (MTU) which is the size of the largest protocol data unit (PDU) that can be communicated in a single, network layer, transaction.

I'm generating a few network traffic right now and capture it in Wireshark, unfortunately I'm not sure which one is the MTU size value in PCAP file.

Please let me know how to inspect this value in Wireshark.

Improve this question
1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Commented Jan 5, 2021 at 21:08

4 Answers 4

Reset to default
9

There is nothing in the packet that will tell you what the MTU is. It's an attribute of an interface. The MTU can vary along the path from source to destination. So for example, the link from A to B might have an MTU of X, but the link from B to C, might be Y. There's no way to tell from the PCAP file.

You might be able to infer the MTU value of some link the packet traveled if you see fragmented packets. But that would be an educated guess at best.

Improve this answer
9
  • MTU is available on TCP SYN packets anyway.
    – Joshua
    Commented Apr 10, 2018 at 19:27
  • 1
    @Joshua You mean MSS, don't you? This is derived from the destination's MTU which might be the path MTU - or not.
    – Zac67 ♦
    Commented Apr 10, 2018 at 19:58
  • @Zac67: My understanding is that intermediate routers are intended to edit it so that by the time it is received it is the path MTU.
    – Joshua
    Commented Apr 10, 2018 at 20:00
  • @Joshua I see - since routers are supposed to be L3 devices, this doesn't usually work and has been pretty much abandoned. Path MTU Discovery works by actually trying to send packets of the desired size, on IPv4 this requires the DF bit to be set.
    – Zac67 ♦
    Commented Apr 10, 2018 at 20:25
  • 2
    @Joshua Intermediate routers are not intended to edit the MSS. But some are able to do it as a workaround for broken PMTU discovery. That technique is usually called MSS clamping. And it is a very effective way to work around networks which broke PMTU discovery one way or another.
    – kasperd
    Commented Apr 10, 2018 at 22:52
2

As Ron has nicely explained, you can't reliably observe the MTU in a packet capture. You can find a minimum value from the largest frame size you've observed (minus L2 overhead) and you can guess.

Since the MTU is a property of the IP binding to a network interface you can just ask your operating system, e.g. in Windows

netsh interface ipv4 show interfaces

You'd need to do that for every single node as there's no way to tell from the outside - there's no standard protocol to ask a node via network.

Improve this answer
0

If you have SYN packet, then the MSS is 1460, so the MTU is 1500(Add 40 (20 for TCP header bytes, 20 for IP header bytes) and you have the MTU value)

Improve this answer
1
  • You didn't read the other answers/comments here, did you?
    – manish ma
    Commented Jul 5 at 14:38
-1

Can you see in that sentence....

enter image description here

Improve this answer
2
  • 1
    That is not the MTU. That is the TCP segment size after the IP packet fragments have been reassembled. You cannot determine the MTU from what you show.
    – Ron Maupin ♦
    Commented Oct 19, 2021 at 17:22
  • While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. - From Review
    – rnxrx
    Commented Oct 24, 2021 at 1:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.