10 Nov
2015
10 Nov
'15
6:45 p.m.
On Nov 9, 2015, at 11:34 AM, Steve Clark sclark@netwolves.com wrote:
IP 10.79.4.53.64327 > 10.79.2.53.24294: Flags [.], seq 16060:29200, ack 1, win 32767, length 13140
Do you have RSS enabled? With RSS the software/tcpdump sees larger "packets" but the physical NIC chunks down to the wire MTU. What does a capture on the destination show?