On Jun 25, 2008, at 11:54 AM, Martin Andersson wrote:
I have a capture with very large tcp packets (it's a ftp session).
My concern is that I can't see any IP fragments.
Perhaps either
1) there aren't any - if this is gigabit Ethernet, it might be using
jumbo frames:
http://en.wikipedia.org/wiki/Jumbo_Frame
or
2) the network adapter on the machine doing the capture is doing IP
fragment reassembly and passing simulated jumbo frames to the host
or
3) the network adapter on the machine is doing TCP segmentation
offloading on the receive side and passing simulated jumbo frames to
the host.