tcpdump抓的tcp包超过了mtu问题

 

本来是处理tcpreplay mtu重新分割问题，最后发现可以tcpdump抓包处理mtu- tcpdump抓的tcp包超过了mtu问题

1.关闭gso

参考:

https://www.cnblogs.com/jiangz/archive/2012/12/25/2831862.html [这里讲了要关闭gso但没有说原因]

http://wsfdl.com/%E8%B8%A9%E5%9D%91%E6%9D%82%E8%AE%B0/2016/07/12/tcp_package_large_then_MTU.html [这里说了原因，但没有说如何关闭，但推荐了https://stackoverflow.com/questions/2350985/length-of-captured-packets-more-than-mtu/2351026#2351026 的地址]

原文:

为了降低 CPU 的负载，提高网络的出口带宽，TSO 提供一些较大的缓冲区来缓存 TCP 发送的包，然后由网卡负责把缓存的大包拆分成多个小于 MTU 的包。tcpdump 或者 wireshare 抓取的是网卡上层的包，所以我们可能会观察到大小超过 MTU 的包：

[popexizhi: tcpdump是 从网卡上层抓的包]

2. 从generic segmentation offload 关闭，测试发现还是有1500 以上的mtu，查看详细的原文如下：分析如果是有网卡层的缓存，是不是看看协议是否也有类似的缓存设置

参考: https://stackoverflow.com/questions/2350985/length-of-captured-packets-more-than-mtu/2351026#2351026

打开

https://lists.openwall.net/netdev/2008/11/14/20

这里看到如下:

On 13-11-2008 15:29, Sami Farin wrote:

...

> Oh, I had old ethtool..

> These with v 6:

> 

> # ethtool -k eth0

> Offload parameters for eth0:

> rx-checksumming: off

> tx-checksumming: off

> scatter-gather: off

> tcp segmentation offload: off

> udp fragmentation offload: off

> generic segmentation offload: on    #这个就是要关闭的gso

> 

> Wow.  I turned gso off and now it works just like before.

> No packets over size of mtu anymore, either.

3. 测试了segmentation 果然有，tcp-segmentation-offload, 测试了一下 tso off

再次查看如下，重新测试抓包ok了

[root@localhost post_http]# ethtool -k eth0|grep segmentation

tcp-segmentation-offload: off

        tx-tcp-segmentation: off

        tx-tcp-ecn-segmentation: off

        tx-tcp6-segmentation: off

        tx-tcp-mangleid-segmentation: off

generic-segmentation-offload: off

tx-fcoe-segmentation: off [fixed]

tx-gre-segmentation: off [fixed]

tx-ipip-segmentation: off [fixed]

tx-sit-segmentation: off [fixed]

tx-udp_tnl-segmentation: off [fixed]

tx-gre-csum-segmentation: off [fixed]

tx-udp_tnl-csum-segmentation: off [fixed]

tx-sctp-segmentation: off [fixed]