I have been doing some tests with two CentOS computers located in a local network and I don't understand the results. We have a simple application where a client (x.y.z.204) sends text strings to a server (x.y.z.205). The payload of some captured packets is larger than the MTU:

x.y.z.205:~/ tshark -i br0 "host x.y.z.204"
Capturing on 'br0'
   10 0.000357812 x.y.z.204 ? x.y.z.205 TCP 7306 40866 ? 1234 [ACK] Seq=6793 Ack=1 Win=29312 Len=7240 TSval=1462059169 TSecr=875693118

Specifically, frame 10 is 7306 bytes (7240 bytes of TCP data + 32 bytes of TCP header + 20 bytes of IP header + 14 bytes of Ethernet header).

However, it does not appear that the network interface supports MTUs greater than 1500 bytes. This is indicated by the interface configuration:

x.y.z.204:~/ ip link list
5: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether 00:xx:18:yy:6c:zz brd ff:ff:ff:ff:ff:ff

Or by tests with ICMP:

x.y.z.204:~/ ping -M do -s 7240 x.y.z.205
PING x.y.z.205 (x.y.z.205) 7240(7268) bytes of data.
ping: local error: Message too long, mtu=1500

How is it possible for us to capture 7240 byte packets if the interface configuration or ping tests suggest that the MTU is 1500 bytes?

1 Answer 1


Effects like those may be seen when TCP offloading is active (Large Receive Offloading LRO) - the NIC's offloading engine aggregates multiple TCP segments into a single virtual segment and packet, decreasing host processing overhead.

Background: https://en.wikipedia.org/wiki/TCP_offload_engine

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.