tcp has MSS=1460, but a segment with PUSH flag is overshooting maximum segment size

[Bernhard Riegler]

a wireshark trace will follow.
filter for "ip.len>1500" in the wireshark trace

ProblemType: Bug
DistroRelease: Ubuntu 22.04
Package: linux-modules-6.5.0-14-generic 6.5.0-14.14~22.04.1
ProcVersionSignature: Ubuntu 6.5.0-14.14~22.04.1-generic 6.5.3
Uname: Linux 6.5.0-14-generic x86_64
ApportVersion: 2.20.11-0ubuntu82.5
Architecture: amd64
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Sun Jan 21 08:41:18 2024
Dependencies:

InstallationDate: Installed on 2022-05-31 (599 days ago)
InstallationMedia: Ubuntu 22.04 LTS "Jammy Jellyfish" - Release amd64 (20220419)
SourcePackage: linux-hwe-6.5
UpgradeStatus: No upgrade log present (probably fresh install)

[Bernhard Riegler (riegler-b)]

I have a stateless firewall (nft) which drops ip.len>1500 input ethernet frames.
therefore you see TCP flow control with resend data.

filter the wireshark trace with "ip.len>1500"
all the input ethernet frames (destination ipv4 10.0.0.2) seen in wireshark trace
are dropped in nft filter hook ingress.

filter the tcp connection.

[Bernhard Riegler (riegler-b)]

I monitor with wireshark and it can be any TCP payload.

the common TCP header part is flag PUSH is ON.
It happens in both directions.

[Bernhard Riegler (riegler-b)]

after turning OFF all HW features of the LANIC.
only CRC calculation remains in the LANIC.

I have not seen the effect in wireshark again.
I assume the LANIC was adding TCP segments together.