Re: Why packets (from my ISP to me) on the WAN VC side of my router are twice the size of packets on the Ethernet (and a corresponding twice as many bytes)

[rhkramer@gmail.com]

Thanks!  Maybe I will have to do some wiresharking ;-)  I guess though, that 
without something like a smart router, I'd only be able to look at data going 
in and out of my Linux / Debian computers (by loading wireshark on each), and 
not the other devices on the system.

I will probably spend at least a day (or more) cogitating--I might load 
wireshark on one computer in the meantime.

Oh, a few quick points:

   * the packets are coming in from the network with the bigger MTU (1540 vs. 
1500

   * but, they don's seem to be split in two, instead, the one with the bigger 
MTU is being doubled--maybe there is something wrong / unusual with the way 
the Westell modem reports statistics.  (For example, how can a packet contain 
more bytes / octets than the MTU for that network??)

So, I guess some cogitation, wiresharking, and looking up the exact model of 
my Westell modem and reading up on it (how it reports statistics).

On Tuesday, February 07, 2017 08:42:34 AM tomas@tuxteam.de wrote:
> I've been just half-following the thread, so sorry if I miss
> by a big amount, but... if the packets are crossing from the
> network with the bigger MTU to the one with the smaller one,
> perhaps they are being split[1], resulting in pairs of one big
> and one small packet (i.e. 1500 -> 1460 + 40, plus any header
> overhead, that is).
> 
> There are ways for the sender to say "no" to fragmentation,
> there are ways to "discover" how to set the MTU to have no
> fragmentation end-to-end and there are ways to thwart this
> discovery (dumb firewalls). Welcome to that rabbit hole :-)
> 
> A session with wireshark might bring a lot of light into what
> is going on. Some learning curve expected, but extremely rewarding.
> 
> [1] the technical term is "fragment"
>     https://en.wikipedia.org/wiki/IP_fragmentation
> 
> regards
> -- t