[Bro-Dev] snaplen and drops
jones at tacc.utexas.edu
Thu Oct 27 14:21:25 PDT 2011
What version of linux are you running. Redhat 5 doesn't seem to have a lro option just the gro option which does not seem to affect the LRO behavior.
From: Lothar Braun [mailto:braun at net.in.tum.de]
Sent: Thursday, October 27, 2011 3:41 PM
To: William Jones
Cc: 'Robin Sommer'; Martin Holste; bro-dev at bro-ids.org
Subject: Re: [Bro-Dev] snaplen and drops
On Oct 27, 2011, at 10:30 PM, William Jones wrote:
> The linux kernel will enable Large Receive Offload on nic's that support it. This allows the nic to present multiple contiguous tcp packets as one large packet to the kernel. I hqve seen tcpdump report packet size of 24K on interfaces with MTU sizes of 1500 bytes when LRO is on.
> The only was to turn of this feature in linux righ now is to turn route forwarding on and reboot..
You should be able to turn it off using ethtool:
ethtool -K <dev> lro off
Make sure you turn off GRO as well, if you don't want to have these large packets:
ethtool -K <dev> gro off
Chair for Network Architectures and Services (I8)
Department of Informatics
Technische Universität München
Boltzmannstr. 3, 85748 Garching bei München, Germany
Phone: +49 89 289-18010 Fax: +49 89 289-18033
E-mail: braun at net.in.tum.de
More information about the bro-dev