0

I find a weird behavior in my Linux system, when I curling a web page, the received TCP segments are significant larger THAN the MSS.

here is the output of tcpdump:

00:00:00.000000 IP 10.15.71.190.44503 > 115.239.210.27.80: Flags [S], seq 248491621, win 29200, options [mss 1460,sackOK,TS val 294137 ecr 0,nop,wscale 7], length 0
00:00:00.004210 IP 115.239.210.27.80 > 10.15.71.190.44503: Flags [S.], seq 1384820706, ack 248491622, win 29200, options [mss 1380,sackOK,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,wscale 7], length 0
00:00:00.000063 IP 10.15.71.190.44503 > 115.239.210.27.80: Flags [.], ack 1, win 229, length 0
00:00:00.000082 IP 10.15.71.190.44503 > 115.239.210.27.80: Flags [P.], seq 1:78, ack 1, win 229, length 77
00:00:00.004187 IP 115.239.210.27.80 > 10.15.71.190.44503: Flags [.], ack 78, win 193, length 0
00:00:00.002929 IP 115.239.210.27.80 > 10.15.71.190.44503: Flags [P.], seq 1:819, ack 78, win 193, length 818
00:00:00.000032 IP 10.15.71.190.44503 > 115.239.210.27.80: Flags [.], ack 819, win 241, length 0
00:00:00.000075 IP 115.239.210.27.80 > 10.15.71.190.44503: Flags [P.], seq 819:16385, ack 78, win 193, length 15566
00:00:00.000016 IP 10.15.71.190.44503 > 115.239.210.27.80: Flags [.], ack 16385, win 485, length 0
00:00:00.000016 IP 115.239.210.27.80 > 10.15.71.190.44503: Flags [.], seq 16385:19105, ack 78, win 193, length 2720
00:00:00.000009 IP 10.15.71.190.44503 > 115.239.210.27.80: Flags [.], ack 19105, win 527, length 0
00:00:00.000086 IP 115.239.210.27.80 > 10.15.71.190.44503: Flags [.], seq 19105:20465, ack 78, win 193, length 1360
00:00:00.000009 IP 10.15.71.190.44503 > 115.239.210.27.80: Flags [.], ack 20465, win 548, length 0
00:00:00.001338 IP 115.239.210.27.80 > 10.15.71.190.44503: Flags [.], seq 20465:28625, ack 78, win 193, length 8160
00:00:00.000015 IP 10.15.71.190.44503 > 115.239.210.27.80: Flags [.], ack 28625, win 676, length 0
00:00:00.132259 IP 115.239.210.27.80 > 10.15.71.190.44503: Flags [.], seq 28625:42225, ack 78, win 193, length 13600
00:00:00.000027 IP 10.15.71.190.44503 > 115.239.210.27.80: Flags [.], ack 42225, win 888, length 0
00:00:00.003511 IP 115.239.210.27.80 > 10.15.71.190.44503: Flags [P.], seq 42225:55825, ack 78, win 193, length 13600
00:00:00.000035 IP 10.15.71.190.44503 > 115.239.210.27.80: Flags [.], ack 55825, win 1101, length 0
00:00:00.000041 IP 115.239.210.27.80 > 10.15.71.190.44503: Flags [.], seq 55825:58545, ack 78, win 193, length 2720
00:00:00.000033 IP 10.15.71.190.44503 > 115.239.210.27.80: Flags [.], ack 58545, win 1143, length 0
00:00:00.001683 IP 115.239.210.27.80 > 10.15.71.190.44503: Flags [.], seq 58545:61265, ack 78, win 193, length 2720
00:00:00.000012 IP 10.15.71.190.44503 > 115.239.210.27.80: Flags [.], ack 61265, win 1186, length 0
00:00:00.000027 IP 115.239.210.27.80 > 10.15.71.190.44503: Flags [.], seq 61265:63985, ack 78, win 193, length 2720
00:00:00.000007 IP 10.15.71.190.44503 > 115.239.210.27.80: Flags [.], ack 63985, win 1228, length 0
00:00:00.000034 IP 115.239.210.27.80 > 10.15.71.190.44503: Flags [.], seq 63985:69425, ack 78, win 193, length 5440
00:00:00.000008 IP 10.15.71.190.44503 > 115.239.210.27.80: Flags [.], ack 69425, win 1313, length 0
00:00:00.001476 IP 115.239.210.27.80 > 10.15.71.190.44503: Flags [.], seq 69425:83025, ack 78, win 193, length 13600
00:00:00.000033 IP 10.15.71.190.44503 > 115.239.210.27.80: Flags [.], ack 83025, win 1300, length 0
00:00:00.004061 IP 115.239.210.27.80 > 10.15.71.190.44503: Flags [P.], seq 83025:89274, ack 78, win 193, length 6249
00:00:00.000026 IP 10.15.71.190.44503 > 115.239.210.27.80: Flags [.], ack 89274, win 1380, length 0
00:00:00.000139 IP 10.15.71.190.44503 > 115.239.210.27.80: Flags [F.], seq 78, ack 89274, win 1411, length 0
00:00:00.004609 IP 115.239.210.27.80 > 10.15.71.190.44503: Flags [.], ack 79, win 193, length 0
00:00:00.000038 IP 115.239.210.27.80 > 10.15.71.190.44503: Flags [F.], seq 89274, ack 79, win 193, length 0
00:00:00.000018 IP 10.15.71.190.44503 > 115.239.210.27.80: Flags [.], ack 89275, win 1411, length 0

As you can see, in TCP handshake, the MSS is 1380.

I have no idea how can this happen, my local link have a MTU of 1500. And I have tried this in My Windows, in Windows it is OK.

Improve this question

1 Answer 1

Reset to default
0

Perhaps the NIC in your Linux system has some hardware TCP offloading features enabled and so the kernel does not see the packets until the NIC has handled them (and thus modified the results).

Improve this answer
1
  • OK, it's Linux GRO. When I turn this offsudo ethtool -K wlp3s0 gro off, the segment is below 1360, funny.
    – Sgra Ekim
    Feb 25, 2015 at 12:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .