Re: Why packets (from my ISP to me) on the WAN VC side of my router are twice the size of packets on the Ethernet (and a corresponding twice as many bytes)

[<tomas@tuxteam.de>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, Feb 07, 2017 at 08:26:46AM -0500, rhkramer@gmail.com wrote:
> Dan (and Lisi): Thanks for the responses!
> 
> On this one I will need to cogitate a little before either understanding fully 
> (and reaching "enlightenment") or responding with further questions.
> 
> But I do have two quick comments:
> 
> 1.  I am definitely comparing the IN on one side of the modem to the OUT on the 
> other, and

I've been just half-following the thread, so sorry if I miss
by a big amount, but... if the packets are crossing from the
network with the bigger MTU to the one with the smaller one,
perhaps they are being split[1], resulting in pairs of one big
and one small packet (i.e. 1500 -> 1460 + 40, plus any header
overhead, that is).

There are ways for the sender to say "no" to fragmentation,
there are ways to "discover" how to set the MTU to have no
fragmentation end-to-end and there are ways to thwart this
discovery (dumb firewalls). Welcome to that rabbit hole :-)

A session with wireshark might bring a lot of light into what
is going on. Some learning curve expected, but extremely rewarding.

[1] the technical term is "fragment"
    https://en.wikipedia.org/wiki/IP_fragmentation

regards
- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAliZzsoACgkQBcgs9XrR2kajVgCfWuda9h5Xu5tbjT5ZJ3bAYfcc
Hg4AnjT7+VBfC1UejeLZlMJmWBKizbV1
=sRJE
-----END PGP SIGNATURE-----