I have been doing some tests with two CentOS computers located in a local network and I don't understand the results. We have a simple application where a client (x.y.z.204) sends text strings to a server (x.y.z.205). The payload of some captured packets is larger than the MTU:
x.y.z.205:~/ tshark -i br0 "host x.y.z.204"
Capturing on 'br0'
[...]
10 0.000357812 x.y.z.204 ? x.y.z.205 TCP 7306 40866 ? 1234 [ACK] Seq=6793 Ack=1 Win=29312 Len=7240 TSval=1462059169 TSecr=875693118
[...]
Specifically, frame 10 is 7306 bytes (7240 bytes of TCP data + 32 bytes of TCP header + 20 bytes of IP header + 14 bytes of Ethernet header).
However, it does not appear that the network interface supports MTUs greater than 1500 bytes. This is indicated by the interface configuration:
x.y.z.204:~/ ip link list
[...]
5: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
link/ether 00:xx:18:yy:6c:zz brd ff:ff:ff:ff:ff:ff
[...]
Or by tests with ICMP:
x.y.z.204:~/ ping -M do -s 7240 x.y.z.205
PING x.y.z.205 (x.y.z.205) 7240(7268) bytes of data.
ping: local error: Message too long, mtu=1500
^C
How is it possible for us to capture 7240 byte packets if the interface configuration or ping tests suggest that the MTU is 1500 bytes?