Timeline for What and how length is determined in tcpdump
Current License: CC BY-SA 4.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 9, 2018 at 13:40 | history | edited | Kiwy | CC BY-SA 4.0 |
added 15 characters in body
|
| Oct 8, 2018 at 16:57 | comment | added | Rui F Ribeiro | I would add MTU on the mix ;) | |
| Oct 8, 2018 at 14:03 | comment | added | agc | Re ...a stream of bytes varying in broadband used with the amount of message to send.": this is unclear and depending on the actual meaning perhaps ungrammatical. Why "broadband used"? Not all connections are uniformly broadband, and some of the world's remote TCP/IP interconnections use no broadband whatsoever. | |
| Oct 8, 2018 at 13:55 | history | edited | agc | CC BY-SA 4.0 |
Cleaned up. (some.)
|
| Oct 8, 2018 at 10:29 | comment | added | Chris Davies |
Oh , ok. I was sure that tcpdump/tshark didn't reassemble fragmented packets when showing wire-level traffic. (I know it reassembles for higher level protocols.)
|
|
| Oct 8, 2018 at 9:43 | comment | added | Kiwy | @roaima Oh I see what you mean, I will make explicit the fact that TCP is 65635 B and is reconstructed from fragmented ethernet packet that could be smaller anyway. | |
| Oct 8, 2018 at 9:32 | comment | added | Chris Davies | Sure. Just slightly puzzled why we're seeing larger packets on the wire. | |
| Oct 8, 2018 at 9:30 | comment | added | Kiwy | @roaima Also this is marginally relevant, it doesn't change the general idea behind my answer. | |
| Oct 8, 2018 at 9:19 | comment | added | Kiwy | Yes I know, but they are only use in very specific environment, mostly on storage as they most of the time create more trouble than they solve problems | |
| Oct 8, 2018 at 9:11 | comment | added | Chris Davies | You've not considered jumbo frames. These packets are all >1500 bytes | |
| Oct 8, 2018 at 8:56 | history | answered | Kiwy | CC BY-SA 4.0 |