17

I'm trying to understand some behavior I'm seeing in the context of sending UDP packets.

I have two little Java programs: one that transmits UDP packets, and the other that receives them. I'm running them locally on my network between two computers that are connected via a single switch.

The MTU setting (reported by /sbin/ifconfig) is 1500 on both network adapters.

  • If I send packets with a size < 1500, I receive them. Expected.
  • If I send packets with 1500 < size < 24258 I receive them. Expected. I have confirmed via wireshark that the IP layer is fragmenting them.
  • If I send packets with size > 24258, they are lost. Not Expected. When I run wireshark on the receiving side, I don't see any of these packets.

I was able to see similar behavior with ping -s.

ping -s 24258 hostA works but

ping -s 24259 hostA fails.

Does anyone understand what may be happening, or have ideas of what I should be looking for?

Both computers are running CentOS 5 64-bit. I'm using a 1.6 JDK, but I don't really think it's a programming problem, it's a networking or maybe OS problem.

5
  • You may have better luck asking this on serverfault.com. Commented Sep 14, 2010 at 19:27
  • 3
    What does wireshark show on the sending side of the connection for packets with size > 24258 ? Commented Sep 14, 2010 at 19:31
  • 1
    @Kaleb I'm not a wireshark expert, but the capture on the sending side looks the same whether the packet size is > or < 24258. I see fragmented IP packets, but I only see the UDP packets for small packets (I have a mix of very small and very large packets). The data I'm sending is binary, so it's hard to figure out what IP packet belongs to what UDP packet. I might try making a simpler test with more predictable data and see what wireshark shows. I might not get to that until tomorrow though. @ire_and_curses, thanks I wasn't sure what serverfault exactly encompassed. I might try there.
    – wolfcastle
    Commented Sep 14, 2010 at 20:42
  • 3
    You UDP and ping tests are a little different. ping -s 24258 will give a packet of size 24266 (8 bytes overhead for ICMP) to the IP layer. A UDP packet size of 24258 will give a packet size of 24278 (20 bytes overhead for UDP) to the IP layer.
    – camh
    Commented Sep 15, 2010 at 0:32
  • Try replacing or removing (cross-over cable) the switch. If one side is sending and the other is not receiving, I'd be looking in the middle for the problem.
    – camh
    Commented Sep 15, 2010 at 0:33

2 Answers 2

12

Implementations of the IP protocol are not required to be capable of handling arbitrarily large packets. In theory, the maximum possible IP packet size is 65,535 octets, but the standard only requires that implementations support at least 576 octets.

It would appear that your host's implementation supports a maximum size much greater than 576, but still significantly smaller than the maximum theoretical size of 65,535. (I don't think the switch should be a problem, because it shouldn't need to do any defragmentation -- it's not even operating at the IP layer).

The IP standard further recommends that hosts not send packets larger than 576 bytes, unless they are certain that the receiving host can handle the larger packet size. You should maybe consider whether or not it would be better for your program to send a smaller packet size. 24,529 seems awfully large to me. I think there may be a possibility that a lot of hosts won't handle packets that large.

Note that these packet size limits are entirely separate from MTU (the maximum frame size supported by the data link layer protocol).

1
  • 1
    I was not aware that implementations could have a smaller maximum packet size. Do you know how to determine what this value is? I agree 24k is a very large size, and I probably won't be sending that large of packets in the deployed system, I just ran across this during testing. I have full control over the network in the deployed system (all computers/switches/routers). We're using Gigabit ethernet, so if we also use jumbo frames I gather I should be able to use a packet size of 9000 (UDP headers + payload) without IP layer fragmenting.
    – wolfcastle
    Commented Sep 15, 2010 at 15:41
5

I found the following which may be of interest:

Dan's answer is useful but note that after headers you're really limited to 65507 bytes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.