Forum Discussion
Morten_Marstran
Nov 07, 2017Nimbostratus
Hi,
This is expected behaviour when you use Wireshark from an endpoint, and the client is running TCP segmentation offload (TSO). TSO offloads the dividing of data from the CPU to the NIC.
Basically, this means that Wireshark picks up the frames, before they go out on a network wire, and you will see the length of each packet before the data is divided.
There are a lot of articles on this, if you want to read more.
Just do a google search for the following: Wireshark shows network packet larger than MTU
Best regards,
Morten