Chapter 15 — MTU: the maximum size of a packet

The key numbers

   MTU  (Maximum Transmission Unit)  = the biggest IP packet a link will carry
   MSS  (Maximum Segment Size)       = the biggest chunk of DATA inside it

   Standard Ethernet:   MTU = 1500
                        - 20 bytes IP header
                        - 20 bytes TCP header
                        ---------------------
                        MSS = 1460 bytes of your actual data

Common MTUs you'll meet:

Notice the VPN entries. A VPN wraps your packet inside another packet, and that wrapper costs bytes. This is why VPNs cause MTU problems so often.

What happens when a packet is too big

Two possibilities:

   CASE 1: the sender said "you may split this" (DF bit not set)
     -> the router chops it into FRAGMENTS
     -> slow, fragile, and often blocked by firewalls

   CASE 2: the sender said "DO NOT FRAGMENT" (DF bit set -- TCP always does this)
     -> the router DROPS the packet
     -> and sends back ICMP "Fragmentation Needed", saying the correct size
     -> the sender shrinks its packets and retries

Case 2 is called Path MTU Discovery (PMTUD), and it works well — as long as that ICMP message gets through.

The classic bug: the PMTU black hole

Someone blocks all ICMP on a firewall "for security" (Chapter 14). Now:

   1. TCP handshake works fine        (those packets are tiny)
   2. Your request works fine          (also small)
   3. The server sends a full-size 1500-byte response packet
   4. A router on the path can't fit it, drops it, sends ICMP...
   5. ...which is BLOCKED. The sender never learns.
   6. The sender retransmits the same too-big packet. Forever.

   RESULT: the connection CONNECTS and then HANGS.

Learn this fingerprint. It is one of the most common "impossible" bugs:

"SSH connects then freezes." "Small web pages load, big ones hang." "git clone stalls at a few KB." "It works on the office Wi-Fi but not over the VPN."

All four are usually MTU.

How to diagnose it in 30 seconds

ping can send a specific size with "don't fragment" set:

# Linux
ping -M do -s 1472 -c 2 example.com     # 1472 + 8 (ICMP) + 20 (IP) = 1500

# macOS
ping -D -s 1472 -c 2 example.com

• Works? Path MTU is at least 1500. Good.
• "Message too long" / "Frag needed"? Something on the path is smaller.

Now binary search for the real limit:

for s in 1472 1452 1422 1372 1272; do
  echo -n "payload $s: "
  ping -M do -s $s -c 1 -W 2 example.com >/dev/null 2>&1 && echo OK || echo TOO BIG
done

The largest size that works, plus 28, is your path MTU.

Or just use:

tracepath example.com        # Linux -- reports the MTU per hop, no root needed

How to fix it

# Linux -- lower your MTU, see what happens, then put it back
ip link show eth0 | grep mtu           # note the current value
sudo ip link set eth0 mtu 1200
curl -s -o /dev/null -w '%{http_code}\n' https://example.com
sudo ip link set eth0 mtu 1500         # PUT IT BACK

sudo tcpdump -i any -n 'ip[6:2] & 0x3fff != 0'   # captures only fragments
# in another terminal:
ping -s 4000 -c 1 192.168.1.1      # a 4000-byte ping must be fragmented