Quick primer: MTU (Maximum Transmission Unit) is the largest link-layer packet a network segment will carry without IP fragmentation. Misaligned MTU values or encapsulation overhead (tunnels, VPNs) commonly cause subtle packet drops, poor performance, and “blackhole” connections where large flows fail silently.
Why this matters
- MTU affects TCP performance and whether packets are fragmented. Fragmentation can hurt latency and reliability; IPv6 drops oversized packets instead of fragmenting.
- MSS (Maximum Segment Size) is the TCP-side payload limit derived from MTU minus IP/TCP headers. If MSS isn't adjusted when MTU changes (encapsulation, tunnels), TCP may send packets that get dropped.
Common blackhole MTU symptoms
- Large downloads or SSH sessions hang while small packets succeed.
- Intermittent connectivity for specific paths or through tunnels.
- ICMP “fragmentation needed” messages absent or blocked.
Quick troubleshooting checklist
- Confirm link MTU (Ethernet commonly 1500; jumbo frames >1500). Check tunnel overhead and subtract it from effective MTU.
- Test path MTU with a DF-bit ping: (Linux) ping -M do -s to find the largest non-fragmented payload.
- Use tracepath/traceroute or tcpdump to observe ICMP "fragmentation needed" replies.
- Apply MSS clamping on routers/firewalls to avoid oversized TCP segments (example iptables rule shown below).
Pro tips & fixes
- MSS clamping (iptables example):
iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu - When using tunnels/VPNs, subtract encapsulation bytes from MTU or enable PMTUD/PLPMTUD where possible.
- Ensure middleboxes don’t block ICMP “fragmentation needed” messages — PMTUD depends on them.
Want a concise, practical walkthrough with commands, examples, and tunnel overhead tables? Read the full evergreen guide (includes MSS clamping recipes and PMTUD/PLPMTUD notes)