I have been doing some tests with two CentOS computers located in a local network and I don't understand the results. We have a simple application where a client (x.y.z.204) sends text strings to a server (x.y.z.205). The payload of some captured packets is larger than the MTU:
x.y.z.205:~/ tshark -i br0 "host x.y.z.204" Capturing on 'br0' [...] 10 0.000357812 x.y.z.204 ? x.y.z.205 TCP 7306 40866 ? 1234 [ACK] Seq=6793 Ack=1 Win=29312 Len=7240 TSval=1462059169 TSecr=875693118 [...]
Specifically, frame 10 is 7306 bytes (7240 bytes of TCP data + 32 bytes of TCP header + 20 bytes of IP header + 14 bytes of Ethernet header).
However, it does not appear that the network interface supports MTUs greater than 1500 bytes. This is indicated by the interface configuration:
x.y.z.204:~/ ip link list [...] 5: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000 link/ether 00:xx:18:yy:6c:zz brd ff:ff:ff:ff:ff:ff [...]
Or by tests with ICMP:
x.y.z.204:~/ ping -M do -s 7240 x.y.z.205 PING x.y.z.205 (x.y.z.205) 7240(7268) bytes of data. ping: local error: Message too long, mtu=1500 ^C
How is it possible for us to capture 7240 byte packets if the interface configuration or ping tests suggest that the MTU is 1500 bytes?