Tcpdump The TCP packet caught exceeds the MTU and is not synchronized with the ACK frame serial number

Recently, using tcpdump to study and analyze TCP parameters, the results of the grab package under Linux at first made me wonder that Ubuntu and Debian had the same phenomenon on hand.

The specific is to catch the sender of the TCP data segment of the length of the regular change, and the receiver reply to receive the frame of the serial number and the sender is not synchronized, for example, the sender sent a serial number of 25:7,265, the receiver replied to the ACK is a serial number is 2921. And ACK confirmed after the serial number is in accordance with the law of increasing.

Looking for a while, or found the answer on the stackoverflowhttp://stackoverflow.com/a/2351026/1429809, because Linux opened the GSO (generic segmentation Offload) option, just turn this option off to get the tcpdump output back to normal. The specific steps are as follows

View system-related options

Ethtool-k eth0

Close GSO

Ethtool-k eth0 GSO off

Author: cnblogs Juejiang

More Wonderful content: http://www.bianceng.cnhttp://www.bianceng.cn/OS/Linux/