Re: MSS=1262

[Sake Blok <sake () euronet nl>]

On 14 dec 2010, at 09:23, vincent paul wrote:

> Is there any rationale ( security "protocol" or something...) to use MSS= 1212, 1260 or 1262?

Using a lower MSS happens when a link in the path has a smaller MTU than 1500. This can be a physical link or can be a 
virtual link which causes encapsulation (GRE, IPsec, MPLS, etc). The initial MSS in the SYN packet is then lowered by 
intermediate devices so that fragmentation at the IP layer is not needed along the way. A system might also configure a 
lower MTU size itself to prevent fragmentation along the way. This can be useful if the routers along the path do not 
change the MSS in the SYN packets.

The values 1212, 1260 and 1262 do seem low to me and would suggest either a link with a very low MTU or many 
encapsulations. Or fragmentation-paranoia on the side of the system administrator :-)

Cheers, 


Sake

PS Please do not create a new topic by responding to another message, this messes up threading in mailreaders that 
support threads and might make your message go unnoticed.

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe