A connection can open successfully and still stall when it starts sending larger packets. When you see that pattern, check MTU before blaming bandwidth or the application.
Key Takeaways
- MTU includes IP headers; path MTU follows the smallest link on your route.
- Oversized packets may be fragmented or dropped, depending on protocol rules.
- Tunnels consume packet space, and blocked ICMP can prevent automatic recovery.
What Is MTU?
Maximum transmission unit (MTU) is the largest IP packet, in bytes, that a link can carry without fragmentation. It includes the IP header and payload, but excludes Ethernet framing. Standard Ethernet commonly uses a 1500-byte IP MTU.
Your path MTU is the smallest link MTU along the route, so matching endpoint settings alone does not establish a safe packet size. A route with 1500-byte links and one 1400-byte link has a path MTU of 1400 bytes.
{{cool-component}}
How MTU Affects Network Performance and Reliability
Larger packets carry more data per header and reduce per-packet processing. Excessively small packets waste capacity; oversized packets can trigger packet fragmentation or loss. Fragmentation adds headers and reassembly work, and losing one fragment prevents reassembly of that packet.
Path MTU Discovery and How It Works
Classical path MTU discovery (PMTUD) uses router feedback to help your sender select packets that fit.
Under RFC 1191, an IPv4 router may fragment only when permitted. With Don't Fragment (DF) set, it discards oversized packets and returns fragmentation-needed ICMP. Your sender lowers its path estimate using the reported next-hop MTU.
IPv6 routers never fragment. RFC 8201 uses ICMPv6 Packet Too Big feedback; senders can reduce packet size or perform source fragmentation.
Packetization-layer discovery sends controlled probes and checks delivery confirmation to identify working packet sizes, recovering from black holes without relying on ICMP. RFC 8899 specifies this approach for datagram transports.
MTU in CDN and Tunnel Environments
Encapsulation reduces your effective inner MTU. With a 1500-byte outer path limit and 50 bytes of added overhead, 1450 bytes remain for the inner IP packet. This is illustrative, not a universal tunnel setting.
A multi-CDN strategy needs separate path checks for each provider, including client-facing and origin-facing connections. Failover may change the effective path MTU, so retest larger transfers after switching providers.
{{cool-component}}
How to Diagnose and Fix MTU Problems in Practice
I'd check packet-size evidence before changing configuration:
- Test both directions and each CDN route with controlled size probes, recording the largest successful and smallest failing packet sizes.
- For IPv4 ping, set DF. A 1472-byte payload plus 28 bytes of base IP/ICMP headers tests a 1500-byte packet.
- Capture retransmissions and size-related ICMP; verify that inner MTU plus tunnel overhead fits the outer path.
- Allow necessary ICMP feedback while retaining other CDN security protections.
Apply a verified MTU to the affected interface or route. TCP MSS clamping adjusts advertised TCP payload limits; it does not fix QUIC/UDP MTU problems.
Conclusion
Set MTU from the real path and encapsulation overhead. Validate larger transfers after changes, preserving discovery feedback and testing every delivery route.
FAQs
What Is the Difference Between MTU and MSS?
MTU limits the entire IP packet; MSS, or maximum segment size, limits TCP data. For a 1500-byte MTU, TCP MSS is normally 1460 bytes with 20-byte IPv4 and TCP headers, or 1440 bytes with a 40-byte IPv6 base header and 20-byte TCP header. Options reduce actual payload further, even when the advertised MSS stays unchanged.
What Is a Jumbo Frame and When Is It Used?
Jumbo frames carry larger Ethernet payloads, commonly allowing an IP MTU around 9000 bytes. You use them on consistently configured private networks, such as storage networks, to reduce packet-processing overhead. Every link must support the chosen size; enabling jumbo frames locally does not extend that support across the Internet.
How Does MTU Misconfiguration Affect CDN Tunnel Performance?
When encapsulation pushes packets beyond the outer path MTU, they may be fragmented or discarded. You might see origin fetches stall despite healthy connection checks. Correct the tunnel's inner MTU for its actual overhead, and verify discovery feedback reaches the sender in both directions.
Does MTU Size Affect TLS Handshake Performance?
Yes, through packet delivery rather than encryption speed. Larger TLS certificate chains can expose an MTU black hole even after TCP connects successfully. TLS messages can span packets normally; trouble occurs when oversized packets disappear and the transport fails to adapt, causing retransmissions or timeouts.
Why Does ICMP Blocking Cause Silent MTU Failures?
Classical PMTUD needs ICMP feedback to discover that packets exceed a link's limit. Blocking the relevant messages leaves your sender unaware of the smaller path MTU. Small exchanges may succeed while larger data stalls. Packetization-layer discovery can detect these failures through probing and recover without ICMP.
