English
The MTU Black Hole: When Small Packets Work
Small interactive requests work while larger output stalls. Compare packet sizes, feedback and retransmissions across the tunnel.
IN THIS ARTICLE+
An SSH session opens over a tunnel. Typing a command works. Printing a large response freezes the connection. This pattern can occur when a sender transmits packets too large for a segment of the path and the message needed to reduce their size never reaches it.
Understand the missing feedback
The path MTU is the largest IP packet size that can traverse a path without fragmentation. Encapsulation consumes part of the available space. A tunnel that carries traffic over a 1,500-byte underlying link cannot necessarily carry a 1,500-byte inner packet unchanged.
In classic IPv4 Path MTU Discovery, a packet with Don't Fragment set that is too large for a next hop should elicit an ICMP fragmentation-needed response. If that feedback is filtered, the sender can keep retransmitting data that never arrives. IPv6 uses ICMPv6 Packet Too Big for this purpose; intermediate IPv6 routers do not fragment the packet for the sender.
Form a testable hypothesis
Compare short and long transfers through the same endpoints. Capture at both sides if authorized. Look for repeated large TCP segments without acknowledgments while small exchanges succeed. Test controlled packet sizes with tools appropriate to the operating system. Distinguish payload size from total IP packet size and account for protocol headers.
A missing ping reply alone is weak evidence: filtering, rate limits and asymmetric paths can produce similar observations. Offload features can also make a host capture show packets larger than those actually placed on the wire.
Fix the boundary
Check tunnel MTU and permitted control messages. TCP MSS adjustment can be useful in a particular design but does not fix every protocol or a fundamentally incorrect MTU. After changing the configuration, repeat the original large transfer in both directions. A smaller ping that happens to work is not a complete acceptance test.
Further reading
IETF RFC 2923: TCP Problems with Path MTU Discovery
Related guide: Read Traceroute Loss Without Blaming the Wrong Hop.
No comments yet. Share the first perspective.