networking mtu_pmtud ai_generated true

ICMP: Fragmentation Needed and Don't Fragment was Set (mtu 1400)

ID: networking/fragmentation-needed

Also available as: JSON · Markdown
88%Fix Rate
90%Confidence
55Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

A router along the path cannot forward a packet because it exceeds the link MTU and the Don't Fragment (DF) bit is set. The router sends an ICMP Fragmentation Needed message. If ICMP is blocked, PMTUD fails silently and connections hang after the initial handshake (PMTUD black hole).

generic

Workarounds

  1. 90% success Reduce the interface MTU to match the path MTU 
    1. Discover the path MTU: ping -M do -s 1472 destination (reduce size until it works)
2. Set the interface MTU: ip link set dev eth0 mtu 1400
3. For tunnels (VPN, VXLAN), account for encapsulation overhead
4. Verify: ping -M do -s $((MTU-28)) destination
5. Make persistent in /etc/network/interfaces or via NetworkManager
  2. 92% success Enable TCP MSS clamping to avoid PMTUD issues 
    1. Clamp MSS at the firewall: iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
2. Or set a specific MSS: iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1360
3. This adjusts the TCP MSS option in SYN packets so data segments fit within the path MTU
4. Verify with tcpdump: tcpdump -i eth0 'tcp[tcpflags] & tcp-syn != 0' -v | grep mss

Dead Ends

Common approaches that don't work:

  1. Clear the DF bit on all outgoing packets to allow fragmentation 70% fail

    IP fragmentation causes significant performance degradation, increases packet loss probability, and some firewalls drop fragments. Modern TCP relies on PMTUD to avoid fragmentation entirely.

  2. Block ICMP entirely for security, breaking PMTUD 90% fail

    Blocking ICMP type 3 code 4 (Fragmentation Needed) breaks Path MTU Discovery completely. Connections that need PMTUD will hang after the handshake when data packets exceed the path MTU.

Error Chain

Leads to:
Preceded by:
Frequently confused with: