[Bro-Dev] snaplen and drops

[Lothar Braun]

Hi,

On Oct 27, 2011, at 10:30 PM, William Jones wrote:

> The linux kernel will enable Large Receive Offload on nic's that support it.   This allows the nic to present multiple contiguous tcp packets as one large packet to the kernel.  I hqve seen tcpdump report packet size of 24K on interfaces with MTU sizes of 1500 bytes when LRO is on.  
> 
> The only was to turn of this feature in linux righ now is to turn route forwarding on  and reboot.. 


You should be able to turn it off using ethtool:

ethtool -K <dev> lro off

Make sure you turn off GRO as well, if you don't want to have these large packets:

ethtool -K <dev> gro off

Best regards,
  Lothar

--
Lothar Braun
Chair for Network Architectures and Services (I8)
Department of Informatics
Technische Universität München
Boltzmannstr. 3, 85748 Garching bei München, Germany
Phone:  +49 89 289-18010       Fax: +49 89 289-18033
E-mail: braun at net.in.tum.de