{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-136-account-for-large-send-offload-when-interpreting-an-azure-vm-packet-capture/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260917-136-account-for-large-send-offload-when-interpreting-an-azure-vm-packet-capture/",
        "slug": "dse-20260917-136-account-for-large-send-offload-when-interpreting-an-azure-vm-packet-capture",
        "url": "https://update.dsesecurity.com/updates/dse-20260917-136-account-for-large-send-offload-when-interpreting-an-azure-vm-packet-capture/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260917-136-account-for-large-send-offload-when-interpreting-an-azure-vm-packet-capture.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-136-account-for-large-send-offload-when-interpreting-an-azure-vm-packet-capture/"
        },
        "title": "Account for large send offload when interpreting an Azure VM packet capture",
        "summary": "A large captured frame does not by itself prove a large network MTU.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-17T16:32:44+00:00",
        "modified_at": "2026-09-17T16:42:36+00:00",
        "reviewed_on": "2026-09-17",
        "reading_minutes": 2,
        "word_count": 223,
        "potentially_affected": "Apply this check when analyzing captures taken on an Azure VM. Identify the capture location, interface, offload configuration and the actual question being investigated. Keep the observed capture size separate from an independently established path-MTU value.",
        "dse_recommendation": "DSE recommends recording offload settings with the capture evidence before recommending an MTU change.",
        "primary_source": {
            "name": "TCP/IP performance tuning for Azure VMs | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-tcpip-performance-tuning",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Microsoft&#8217;s Azure VM networking guide warns that large send offload can produce large frames in packet captures that are mistaken for fragmentation or a larger MTU. With LSO, the adapter advertises a larger segment size to the host stack and then splits the resulting large packet according to its MTU. The capture interpretation must account for that processing. <a href=\"https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-tcpip-performance-tuning\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Apply this check when analyzing captures taken on an Azure VM. Identify the capture location, interface, offload configuration and the actual question being investigated. Keep the observed capture size separate from an independently established path-MTU value.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends recording offload settings with the capture evidence before recommending an MTU change. Ask the network owner to explain where segmentation occurs relative to the observation point. If another approved capture location is available, use it to compare the same test flow. Preserve the initial capture and settings rather than changing several performance controls at once.</p>\n<h2>Verification</h2>\n<p>Correlate the representative transfer across the available observations and compare it with the documented offload behavior. Check actual application success and any independently observed fragmentation or MTU errors. Label conclusions according to what was measured. If offload settings are changed for diagnosis, use an approved reversible test and restore the intended configuration afterward.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-tcpip-performance-tuning\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: TCP/IP performance tuning for Azure VMs</a>.</p>",
        "content_text": "Source facts\nMicrosoft’s Azure VM networking guide warns that large send offload can produce large frames in packet captures that are mistaken for fragmentation or a larger MTU. With LSO, the adapter advertises a larger segment size to the host stack and then splits the resulting large packet according to its MTU. The capture interpretation must account for that processing. Microsoft Learn.\nApplicability\nApply this check when analyzing captures taken on an Azure VM. Identify the capture location, interface, offload configuration and the actual question being investigated. Keep the observed capture size separate from an independently established path-MTU value.\nDSE recommendation\nDSE recommends recording offload settings with the capture evidence before recommending an MTU change. Ask the network owner to explain where segmentation occurs relative to the observation point. If another approved capture location is available, use it to compare the same test flow. Preserve the initial capture and settings rather than changing several performance controls at once.\nVerification\nCorrelate the representative transfer across the available observations and compare it with the documented offload behavior. Check actual application success and any independently observed fragmentation or MTU errors. Label conclusions according to what was measured. If offload settings are changed for diagnosis, use an approved reversible test and restore the intended configuration afterward.\nOfficial references\nMicrosoft Learn: TCP/IP performance tuning for Azure VMs.",
        "content_markdown": "## Source facts\n\nMicrosoft’s Azure VM networking guide warns that large send offload can produce large frames in packet captures that are mistaken for fragmentation or a larger MTU. With LSO, the adapter advertises a larger segment size to the host stack and then splits the resulting large packet according to its MTU. The capture interpretation must account for that processing. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-tcpip-performance-tuning).\n\n## Applicability\n\nApply this check when analyzing captures taken on an Azure VM. Identify the capture location, interface, offload configuration and the actual question being investigated. Keep the observed capture size separate from an independently established path-MTU value.\n\n## DSE recommendation\n\nDSE recommends recording offload settings with the capture evidence before recommending an MTU change. Ask the network owner to explain where segmentation occurs relative to the observation point. If another approved capture location is available, use it to compare the same test flow. Preserve the initial capture and settings rather than changing several performance controls at once.\n\n## Verification\n\nCorrelate the representative transfer across the available observations and compare it with the documented offload behavior. Check actual application success and any independently observed fragmentation or MTU errors. Label conclusions according to what was measured. If offload settings are changed for diagnosis, use an approved reversible test and restore the intended configuration afterward.\n\n## Official references\n\n[Microsoft Learn: TCP/IP performance tuning for Azure VMs](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-tcpip-performance-tuning)."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-136-account-for-large-send-offload-when-interpreting-an-azure-vm-packet-capture/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-136-account-for-large-send-offload-when-interpreting-an-azure-vm-packet-capture/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-17"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-136-account-for-large-send-offload-when-interpreting-an-azure-vm-packet-capture/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Account for large send offload when interpreting an Azure VM packet capture",
                        "item": "https://update.dsesecurity.com/updates/dse-20260917-136-account-for-large-send-offload-when-interpreting-an-azure-vm-packet-capture/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-136-account-for-large-send-offload-when-interpreting-an-azure-vm-packet-capture/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260917-136-account-for-large-send-offload-when-interpreting-an-azure-vm-packet-capture/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-136-account-for-large-send-offload-when-interpreting-an-azure-vm-packet-capture/",
                "headline": "Account for large send offload when interpreting an Azure VM packet capture",
                "description": "A large captured frame does not by itself prove a large network MTU.",
                "abstract": "A large captured frame does not by itself prove a large network MTU.",
                "articleBody": "Source facts\nMicrosoft’s Azure VM networking guide warns that large send offload can produce large frames in packet captures that are mistaken for fragmentation or a larger MTU. With LSO, the adapter advertises a larger segment size to the host stack and then splits the resulting large packet according to its MTU. The capture interpretation must account for that processing. Microsoft Learn.\nApplicability\nApply this check when analyzing captures taken on an Azure VM. Identify the capture location, interface, offload configuration and the actual question being investigated. Keep the observed capture size separate from an independently established path-MTU value.\nDSE recommendation\nDSE recommends recording offload settings with the capture evidence before recommending an MTU change. Ask the network owner to explain where segmentation occurs relative to the observation point. If another approved capture location is available, use it to compare the same test flow. Preserve the initial capture and settings rather than changing several performance controls at once.\nVerification\nCorrelate the representative transfer across the available observations and compare it with the documented offload behavior. Check actual application success and any independently observed fragmentation or MTU errors. Label conclusions according to what was measured. If offload settings are changed for diagnosis, use an approved reversible test and restore the intended configuration afterward.\nOfficial references\nMicrosoft Learn: TCP/IP performance tuning for Azure VMs.",
                "datePublished": "2026-09-17T16:32:44+00:00",
                "dateModified": "2026-09-17T16:42:36+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-136-account-for-large-send-offload-when-interpreting-an-azure-vm-packet-capture/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-136-account-for-large-send-offload-when-interpreting-an-azure-vm-packet-capture/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Account for large send offload when interpreting an Azure VM packet capture"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 223,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "TCP/IP performance tuning for Azure VMs | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-tcpip-performance-tuning"
                }
            }
        ]
    }
}