title: How to send packets larger than 1500 bytes by pcap_sendpacket?
body: <p>Actually, I have two related questions.</p>
  
  <p>I'm capturing filtered network traffic by <a href="http://www.tcpdump.org/">libpcap</a> on Debian. Then I need to replay this traffic on Win2k3 server. Sometimes I capture packets, both TCP and UDP, much larger than 1500 bytes (default MTU size for Ethernet). E.g., 2000+ bytes. I did no specific changes to MTU size on that Linux. So question #1:</p>
  
  <p><strong>What's the reason for these packets much larger than default MTU?</strong> <a href="http://en.wikipedia.org/wiki/Jumbo_Frames">Jumbo frames</a>? This Wikipedia article states that "network interface cards capable of jumbo frames require explicit configuration to use jumbo frames", but I'm not aware about any such configuration. Also <code>ifconfig</code> shows me "MTU:1500". Can it be somehow related with "interrupt-combining" technique (or "interrupt coalescing" as in <a href="http://www.evanjones.ca/ethernet-latency.html">this article</a>)? Can I supress such packets?</p>
  
  <p>Then, question #2:</p>
  
  <p><strong>How can I send such packets by <code>pcap_sendpacket</code> on Windows?</strong> I receive error message "send error: PacketSendPacket failed" only for packets larger than 1500 bytes. Seems I cannot use jumbo frames because I'm sending data to directly connected custom "net tap" like pci card  and I'm not sure I can configure its NIC. What else? Should I fragment these packets according to the protocol rules? </p>
  
  <p><strong>EDIT:</strong></p>
  
  <p>Checked fragmentation by NIC as Guy Harris suggested:</p>
  
  <pre><code>~# ethtool -k eth0
  Offload parameters for eth0:
  rx-checksumming: on
  tx-checksumming: on
  scatter-gather: on
  tcp-segmentation-offload: off
  udp-fragmentation-offload: off
  generic-segmentation-offload: off
  generic-receive-offload: off
  large-receive-offload: off
  ntuple-filters: off
  receive-hashing: off
  </code></pre>
  
  <p>The same for <code>eth1</code> and <code>br0</code> - network bridge between <code>eth0</code> and <code>eth1</code> which I'm sniffing.</p>
  
  <p>And I still receive large UDP packets.</p>