Thanks! Maybe I will have to do some wiresharking ;-) I guess though, that without something like a smart router, I'd only be able to look at data going in and out of my Linux / Debian computers (by loading wireshark on each), and not the other devices on the system.
I will probably spend at least a day (or more) cogitating--I might load wireshark on one computer in the meantime. Oh, a few quick points: * the packets are coming in from the network with the bigger MTU (1540 vs. 1500 * but, they don's seem to be split in two, instead, the one with the bigger MTU is being doubled--maybe there is something wrong / unusual with the way the Westell modem reports statistics. (For example, how can a packet contain more bytes / octets than the MTU for that network??) So, I guess some cogitation, wiresharking, and looking up the exact model of my Westell modem and reading up on it (how it reports statistics). On Tuesday, February 07, 2017 08:42:34 AM to...@tuxteam.de wrote: > I've been just half-following the thread, so sorry if I miss > by a big amount, but... if the packets are crossing from the > network with the bigger MTU to the one with the smaller one, > perhaps they are being split[1], resulting in pairs of one big > and one small packet (i.e. 1500 -> 1460 + 40, plus any header > overhead, that is). > > There are ways for the sender to say "no" to fragmentation, > there are ways to "discover" how to set the MTU to have no > fragmentation end-to-end and there are ways to thwart this > discovery (dumb firewalls). Welcome to that rabbit hole :-) > > A session with wireshark might bring a lot of light into what > is going on. Some learning curve expected, but extremely rewarding. > > [1] the technical term is "fragment" > https://en.wikipedia.org/wiki/IP_fragmentation > > regards > -- t
