["Robinson, Eric" <eric.robinson@xxxxxxxxx>]

 >  It's likely that the NIC has hardware TCP offloading enabled and you're  

>  capturing it before the NIC chops it up to 1460.   If you capture the traffic  

> from the network, you'll likely see the 1460 TCP length packets.
 

If the NIC has offloading enabled, I guess the stack knows this and sends it bigger frames, knowing it will packetize them smaller? Because I went into the adapter properties and turned off all the offloading features, and now it is being reported as expected in WireShark. So I guess when the NIC's offload capabilities are disabled, the stack detects this and only sends it frames that are appropriate for the MTU?

 

--Eric 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Disclaimer - March 23, 2011

This email and any files transmitted with it are confidential and intended solely for Community support list for Wireshark. If you are not the named addressee you should not disseminate, distribute, copy or alter this email. Any views or opinions presented in this email are solely those of the author and might not represent those of Physicians' Managed Care or Physician Select Management. Warning: Although Physicians' Managed Care or Physician Select Management has taken reasonable precautions to ensure no viruses are present in this email, the company cannot accept responsibility for any loss or damage arising from the use of this email or attachments.