[Bro-Dev] snaplen and drops

[William Jones]

What version of linux are you running.   Redhat 5 doesn't seem to have a lro option just the gro option which does not seem to affect the LRO behavior.

Bill Jones

-----Original Message-----
From: Lothar Braun [mailto:braun at net.in.tum.de] 
Sent: Thursday, October 27, 2011 3:41 PM
To: William Jones
Cc: 'Robin Sommer'; Martin Holste; bro-dev at bro-ids.org
Subject: Re: [Bro-Dev] snaplen and drops

Hi,

On Oct 27, 2011, at 10:30 PM, William Jones wrote:

> The linux kernel will enable Large Receive Offload on nic's that support it.   This allows the nic to present multiple contiguous tcp packets as one large packet to the kernel.  I hqve seen tcpdump report packet size of 24K on interfaces with MTU sizes of 1500 bytes when LRO is on.  
> 
> The only was to turn of this feature in linux righ now is to turn route forwarding on  and reboot.. 


You should be able to turn it off using ethtool:

ethtool -K <dev> lro off

Make sure you turn off GRO as well, if you don't want to have these large packets:

ethtool -K <dev> gro off

Best regards,
  Lothar

--
Lothar Braun
Chair for Network Architectures and Services (I8)
Department of Informatics
Technische Universität München
Boltzmannstr. 3, 85748 Garching bei München, Germany
Phone:  +49 89 289-18010       Fax: +49 89 289-18033
E-mail: braun at net.in.tum.de