core switch shows iPhone send packets in size larger than MTU

[seanxiao]

Hi everyone,

Happened to view some logs from our core switch like:

Jan 2 02:27:44.265: SW1: IP: recv fragment from 10.80.36.33 offset 0 bytes
Jan 2 02:27:44.265: SW1: IP: recv fragment from 10.80.36.33 offset 1480 bytes
Jan 2 02:30:01.655: SW1: IP: recv fragment from 10.80.36.131 offset 0 bytes
Jan 2 02:30:01.655: SW1: IP: recv fragment from 10.80.36.131 offset 1480 bytes
Jan 2 02:30:01.755: SW1: IP: recv fragment from 10.80.36.131 offset 0 bytes
Jan 2 02:30:01.755: SW1: IP: recv fragment from 10.80.36.131 offset 1480 bytes
Jan 2 02:30:01.763: SW1: IP: recv fragment from 10.80.36.131 offset 0 bytes
Jan 2 02:30:01.763: SW1: IP: recv fragment from 10.80.36.131 offset 1480 bytes
Jan 2 02:30:04.783: SW1: IP: recv fragment from 10.80.36.131 offset 0 bytes
Jan 2 02:30:04.783: SW1: IP: recv fragment from 10.80.36.131 offset 1480 bytes
Jan 2 02:30:04.795: SW1: IP: recv fragment from 10.80.36.131 offset 0 bytes
Jan 2 02:30:04.795: SW1: IP: recv fragment from 10.80.36.131 offset 1480 bytes
Jan 2 02:30:04.807: SW1: IP: recv fragment from 10.80.36.131 offset 0 bytes
Jan 2 02:30:04.807: SW1: IP: recv fragment from 10.80.36.131 offset 1480 bytes
Jan 2 02:30:07.819: SW1: IP: recv fragment from 10.80.36.131 offset 0 bytes
Jan 2 02:30:07.819: SW1: IP: recv fragment from 10.80.36.131 offset 1480 bytes
Jan 2 02:30:07.831: SW1: IP: recv fragment from 10.80.36.131 offset 0 bytes
Jan 2 02:30:07.831: SW1: IP: recv fragment from 10.80.36.131 offset 1480 bytes
Jan 2 02:30:07.831: SW1: IP: recv fragment from 10.80.36.131 offset 0 bytes
Jan 2 02:30:07.831: SW1: IP: recv fragment from 10.80.36.131 offset 1480 bytes
Jan 2 03:03:42.853: SW1: IP: recv fragment from 10.80.36.18 offset 0 bytes
Jan 2 03:03:42.853: SW1: IP: recv fragment from 10.80.36.18 offset 1480 bytes
Jan 2 03:03:42.861: SW1: IP: recv fragment from 10.80.36.18 offset 0 bytes
Jan 2 03:03:42.861: SW1: IP: recv fragment from 10.80.36.18 offset 1480 bytes
Jan 2 03:03:42.865: SW1: IP: recv fragment from 10.80.36.18 offset 0 bytes
Jan 2 03:03:42.865: SW1: IP: recv fragment from 10.80.36.18 offset 1480 bytes
Jan 2 03:03:45.885: SW1: IP: recv fragment from 10.80.36.18 offset 0 bytes
Jan 2 03:03:45.885: SW1: IP: recv fragment from 10.80.36.18 offset 1480 bytes
Jan 2 03:03:45.893: SW1: IP: recv fragment from 10.80.36.18 offset 0 bytes
Jan 2 03:03:45.893: SW1: IP: recv fragment from 10.80.36.18 offset 1480 bytes
Jan 2 03:03:45.901: SW1: IP: recv fragment from 10.80.36.18 offset 0 bytes
Jan 2 03:03:45.901: SW1: IP: recv fragment from 10.80.36.18 offset 1480 bytes

======

then i checked the arp and all of them are shown as iPhone 15 from wireless WLC (5508 and AP 2800 serires). Is it something that iPhone is sending big packet larger than 1500 (the global MTU we set) so it's fragmented?  It is 1480 in a fragmentation (20 Bytes IP header, total 1500 Bytes),  and 0 in another fragmentation (20 Bytes IP header, total 20),  which means the iphone sends a packet as big as 1520 which got fragmented?

Please advise.

[MHM Cisco World]

https://mrncciew.com/2013/04/07/configuring-tcp-mss/

I think you can from WLC adjust the tcp mss (which reduce the MTU) if traffic is TCP.
MHM

[seanxiao]

Thanks for the help.

We have lots of wireless device type, if it is only with iPhone, then I think we just let it be. It's been showing:

Is there any risk if we manually adjust it?

[Ruben Cocheno]

@seanxiao 

I would investigate first why that Iphone is sending large packets in the first place, as per Apple it should be 3 times smaller than that....

[seanxiao]

thanks , will try to check it.