windows下wireshark抓包经常会出现"TCP segment of a reassembled PDU"提示:
可通过wireshark的 Edit --> Preferences --> Protocols/TCP --> Allow subdissector to reassemble TCP streams 取消勾选该选项可消除提示:
网上大部分转载文章都在争论显示TCP segment of a reassembled PDU的ACK序号是一样的,所以显示提示,其实与ACK没啥关系。
问题的关键在于报文长度2194字节,已超出MTU的1500大小,所以提示TCP segment。
MTU Max Transmit Unit,1500,可通过ifconfig查看
MSS Max Segment Size,1460=1500-20-20
PDU Protocol Data Unit
NIC传输的最大报文长度为1514字节=MTU+Ether=1500+14
那问题来了,2194字节报文为什么是正常的,为何没有经过IP分片?
因为现代OS支持网络分载(TSO)功能,由NIC代替CPU实现packet的分段和合并,节省系统资源,让系统处理更多的连接。
TSO TCP Segment Offload
LSO Large Segment Offload
GSO Generic Segment Offload
LRO Large Receive Offload
RSC Receive Segment Coalescing
发送过程:
Many operating systems and NIC drivers support TCP Segmentation Offload (TSO) aka Large Segment Offload (LSO) aka Generic Segment Offload (GSO). What this means is that the TCP stack sends a chunk of data for the NIC to break up into Maximum Segment Size (MSS) pieces to send on the network. TCP might hand the NIC 16k of data and the NIC will break it into MSS sized bites: 11 segments of 1460 bytes and one segment of the remaining 324 bytes. This offloads the task to the NIC and saves overhead on the host’s resources. It’s a performance thing.
当TCP协议栈发送大块数据时,由NIC来进行分段。由于适配器硬件完成数据分段的速度比操作系统软件快得多,此功能可能会提高传输性能。此外,适配器使用的 CPU 资源较少。
接收过程:
Large Receive Offload (LRO) or Receive Segment Coalescing (RSC). The is the same thing but in reverse. The NIC coalesces TCP segments it receives from a remote host into larger packets before sending them up to the TCP stack.
过程与发送相反,NIC会将接收到的数据合并成大的数据包,然后发送至TCP/IP协议栈。如图wireshark工作在NIC和协议栈之间,抓取的是网卡上的数据,此时数据包长度可能大于MTU。
参考链接:
http://packetbomb.com/how-can-the-packet-size-be-greater-than-the-mtu/
http://rtodto.net/generic_segmentation_offload_and_wireshark/
https://en.wikipedia.org/wiki/Large_receive_offload
相关推荐
1……tcp out-of-order(tcp有问题) 2……tcp segment of a reassembled PDU 3……Tcp previous segment lost(tcp先前的分片丢失) 等
作业四:通过HTTP访问某个网页,使用Wireshark对整个过程中的数据段进行捕获,分析TCP连接建立、数据传输、连接关闭的全过程,至少对其中5个典型的TCP
文章《EDPF: A Realtime Parameter-Free Edge Segment Detector with a False Detection Control》的实现,已成功运行!边缘提取效果不错~
Edge Drawing: A combined real-time edge and segment detector的实现,在最后连线的时候和论文略有区别,按照论文的方法有点问题,最后结果类似,看出问题的朋友可以私信我为什么。
LSD: a Line Segment Detector
使用IAR开发ADI的ADUC70XX系列单片机时,编译出现下面错误提示: Fatal Error[e72]: Segment FIQ_STACK must b
go into production of such reducer to cover another segment of the market. The company is interested in supplying transmissions for robust systems and for various industrial purposes, where large ...
We then estimate an upper bound of the real NLF by fitting a lower envelope to the standard deviations of per-segment image variances. For denoising, the chrominance of color noise is significantly ...
进制转换 这是学汇编语言时的一些程序 对初学者很有帮助
基于17节段心肌节段模型的冠脉评分系统及其验证,徐明星,贺永明,本研究旨在设计一种新的基于17节段模型原理的冠脉评分系统,以便评分冠脉系统病变的复杂性,并充分考虑冠脉变异。我们依据下列原�
谷氨酸刺激大壁虎脊髓L12节段诱发节律运动的研究,王文波,崔冠奇,大壁虎具有超凡的三维空间无障碍运动能力,成为仿生机器人研究开发的理想模型。脊椎动物在亿万年的进化中体现出良好的运动控制能
Segment Routing 思科原厂培训PPT L3/L2 , Traffic Engineering (TE) / Fast Reroute (FRR) services are offered over the MPLS backbone Complex protocol stacks Complex troubleshooting & operation
3 digit counter using 7segment
Laravel开发-segment 为Laravel编写的segment.com包装
传输控制协议(Transport Control ...TCP通过数据分段(Segment)中的序列号保证所有传输的数据可以在远端按照正常的次序进行重组,而且通过确认保证数据传输的完整性。要通过TCP传输数据,必须在两端主机之间建立连接
a Line Segment Detector 一种线段快速检测算法
PI SEGMENT项目的源代码
什么是Segment Routing、背景、实现原理、优势及应用