I have a stateless firewall (nft) which drops ip.len>1500 input ethernet frames.
therefore you see TCP flow control with resend data.
filter the wireshark trace with "ip.len>1500"
all the input ethernet frames (destination ipv4 10.0.0.2) seen in wireshark trace
are dropped in nft filter hook ingress.
I have a stateless firewall (nft) which drops ip.len>1500 input ethernet frames.
therefore you see TCP flow control with resend data.
filter the wireshark trace with "ip.len>1500"
all the input ethernet frames (destination ipv4 10.0.0.2) seen in wireshark trace
are dropped in nft filter hook ingress.
filter the tcp connection.