wireshark shows a frame with 2574 Bytes,
tcpdump shows the same frame as 2574 Bytes
A very good post:
http://sandilands.info/sgordon/segmentation-offloading-with-wireshark-and-ethtool
and you are sure that the MTU is 1500 or lower (no jumbo frames), since you saw the MSS in the SYN and SYN/ACK, so both sides are certainly below 1500.
Apparently this is because of the NIC doing tcp segmentation offloading:
# ethtool -k eth0
Offload parameters for eth0:
rx-checksumming: on
tx-checksumming: on
scatter-gather: on
tcp-segmentation-offload: on
udp-fragmentation-offload: off
generic-segmentation-offload: on
generic-receive-offload: off
large-receive-offload: on
ethtool -K eth0 tso off
ethtool -K eth0 gso off
ethtool -K eth0 gso off
I turned off tcp first but the generic did prevail so I turned off gso and thought I saw only smaller packages but when enabling and disabling it again I did not see the small packets anymore, so maybe a restart is necessary.
Would be nice to see it working or not the 2nd time you disable it. But I won't restart the system.
Would be nice to see it working or not the 2nd time you disable it. But I won't restart the system.







