Why does the ProxySG appliance capture PCAP files in a packet size greater than 1514 bytes?

Products

• ProxySG Software - SGOS

Issue/Introduction

The ProxySG appliance captures PCAP files in large packet sizes because of TCP segmentation offloading, which is a feature that increases the amount of output for high workload network connections. For TCP segmentation offloading, the PCAP capture point occurs within the NIC interface, before the segmentation of data into packets occurs.  The following is an example of a PCAP file:

  93357 09:28:44 Client    ProxySG         HTTP     GET http://image.itmedia.co.jp/mn/articles/1510/07/hi_sh05.jpg HTTP/1.1  611    55734  3080   1293
  93358 09:28:44 ProxySG   Client          HTTP     HTTP/1.1 200 OK  (JPEG JFIF image)[Packet size limited during capture] 7005   3080   55734  1293
  93359 09:28:44 ProxySG   Client          TCP      3080→55734 [PSH, ACK] Seq=106653 Ack=3265 Win=65535 Len=8192[Packet size limited during capture] 8246   3080   55734  1293
  93360 09:28:44 ProxySG   Client          TCP      3080→55734 [PSH, ACK] Seq=114845 Ack=3265 Win=65535 Len=8192[Packet size limited during capture] 8246   3080   55734  1293
  93361 09:28:44 ProxySG   Client          TCP      3080→55734 [ACK] Seq=123037 Ack=3265 Win=65535 Len=3865[Packet size limited during capture] 3919   3080   55734  1293
  93389 09:28:44 Client    ProxySG         TCP      55734→3080 [ACK] Seq=3265 Ack=112093 Win=15405 Len=0          60     55734  3080   1293

ProxySG S400 and S500 models can capture PCAP files when the NIC speed is 10GBps.
 

Resolution

Workaround