# \- MTU and defragmentation

**URL:** <https://community.zeek.org/t/mtu-and-defragmentation/5122>\
**Category:** Zeek\
**Created:** [December 6, 2017, 4:23pm UTC](https://community.zeek.org/t/mtu-and-defragmentation/5122 "2017-12-06T16:23:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![william\_de\_ping](https://avatars.discourse-cdn.com/v4/letter/w/b19c9b/32.png) [@william\_de\_ping](https://community.zeek.org/u/william_de_ping)\
**Post date:** [December 6, 2017, 4:23pm UTC](https://community.zeek.org/t/mtu-and-defragmentation/5122/1 "2017-12-06T16:23:19Z")

</div>

Hello,

I wonder what happens if my mtu is set to 1500 (default) and a jumbo TCP or UDP packet is sent to Bro’s monitored interface.

Will Bro parse only the packet containing the IP header ?

Thanks  
B

---

<div class="post-metadata">

**Author:** ![Jon\_Siwek](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Jon\_Siwek](https://community.zeek.org/u/Jon_Siwek)\
**Post date:** [December 6, 2017, 6:43pm UTC](https://community.zeek.org/t/mtu-and-defragmentation/5122/2 "2017-12-06T18:43:46Z")

</div>

I'd actually expect Bro to reassemble IPv4/IPv6 fragments by default,  
providing that it is actually seeing the fragments from the interface  
in their entirety. Anything relevant in weird.log? e.g. there could  
be other problems going on that prevent fully processing the  
fragments, like bad checksums (maybe from nic offloading), or  
incomplete captures (from too low a snaplen setting).

- Jon

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/mtu-and-defragmentation/5122/3 "2022-05-06T15:45:27Z")

</div>