Wireshark tcp.len and data.len missmatch

Question

What is the difference between tcp.len and data.len filters? I thought that both mean data size traveling in the segment (not including TCP header). I have a problem related to MTU issue and I'm trying to figure if data size from application layer is greater than the MSS announced by the server.

The capture shows some TCP packets encapsulating 1434 Bytes:

But the TCP layer analysis displays the same TCP packets with len = 1448

I think that this TCP segment is encapsulating 1448 Bytes. 1448B plus 32B of TCP header (some TCP options are enabled) plus 20B of IP Header = 1500 Bytes as it is displayed in the analysis of the IP layer.

So I have a question related to this one about MSS clamping. LAN clients are connected to the router using Ethernet with MTU = 1500 Bytes and router is connected to the Internet using PPPoE with MTU = 1492 Bytes. The router is manipulating MSS field in every TCP packet with SYN flag enabled in both directions, this is known as MSS clamping. This way LAN clients receive MSS = 1452 from servers on the Internet and the servers receive MSS = 1452 from the LAN clients.

But what happens if server announces MSS < 1452? LAN clients will receive MSS = 1452 from the server so only PMTUD can work here?

Answer 1

When the server's MSS is less than 1452, the router should not touch the MSS. The client will see the correct value sent by the server.

tcp.len and data.len will match if Wireshark does not interpret the data in the TCP stream. If wireshark can make sense of the data, it can update data.len. They don't have to match.

For example, in the case of HTTP, data.len can contain the total length of an HTTP POST request reassembled from which is spread over multiple TCP segments.