Packet capture shows packets larger than MTU

Question

I have been doing some tests with two CentOS computers located in a local network and I don't understand the results. We have a simple application where a client (x.y.z.204) sends text strings to a server (x.y.z.205). The payload of some captured packets is larger than the MTU:

x.y.z.205:~/ tshark -i br0 "host x.y.z.204"
Capturing on 'br0'
   [...]
   10 0.000357812 x.y.z.204 ? x.y.z.205 TCP 7306 40866 ? 1234 [ACK] Seq=6793 Ack=1 Win=29312 Len=7240 TSval=1462059169 TSecr=875693118
   [...]

Specifically, frame 10 is 7306 bytes (7240 bytes of TCP data + 32 bytes of TCP header + 20 bytes of IP header + 14 bytes of Ethernet header).

However, it does not appear that the network interface supports MTUs greater than 1500 bytes. This is indicated by the interface configuration:

x.y.z.204:~/ ip link list
   [...]
5: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether 00:xx:18:yy:6c:zz brd ff:ff:ff:ff:ff:ff
   [...]

Or by tests with ICMP:

x.y.z.204:~/ ping -M do -s 7240 x.y.z.205
PING x.y.z.205 (x.y.z.205) 7240(7268) bytes of data.
ping: local error: Message too long, mtu=1500
^C 

How is it possible for us to capture 7240 byte packets if the interface configuration or ping tests suggest that the MTU is 1500 bytes?

Answer 1

Effects like those may be seen when TCP offloading is active (Large Receive Offloading LRO) - the NIC's offloading engine aggregates multiple TCP segments into a single virtual segment and packet, decreasing host processing overhead.

Background: https://en.wikipedia.org/wiki/TCP_offload_engine