EMSGSIZE networking mtu_pmtud ai_generated true

Message too long (EMSGSIZE): packet size 1500 exceeds interface MTU 1400

ID: networking/mtu-too-large

Also available as: JSON · Markdown
90%Fix Rate
91%Confidence
55Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

The interface or path MTU is smaller than the packet being sent. Common in tunnel interfaces (VPN, VXLAN, GRE) where encapsulation overhead reduces the effective MTU. TCP connections may hang after the handshake when data packets exceed the path MTU.

generic

Workarounds

  1. 92% success Set the interface MTU to match the path MTU accounting for encapsulation overhead 
    1. Determine the path MTU: ping -M do -s 1472 destination (1472 + 28 bytes IP/ICMP header = 1500)
2. Reduce size until ping succeeds to find the maximum
3. For tunnels, subtract overhead: VXLAN = 50 bytes, GRE = 24 bytes, WireGuard = 60 bytes
4. Set MTU: ip link set dev eth0 mtu 1400
5. Make persistent in netplan, NetworkManager, or /etc/network/interfaces
6. Verify: ip link show eth0 | grep mtu
  2. 90% success Enable TCP MSS clamping to prevent oversized segments 
    1. Add iptables MSS clamp rule: iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
2. This adjusts the MSS in TCP SYN packets to match the outgoing interface MTU
3. Make persistent with iptables-save or nftables configuration
4. Verify by capturing SYN packets: tcpdump -i eth0 'tcp[tcpflags] & tcp-syn != 0' -v

Dead Ends

Common approaches that don't work:

  1. Set the MTU to 9000 (jumbo frames) without verifying all switches and routers support it 80% fail

    If any device in the path does not support jumbo frames, packets are silently dropped. Most internet paths and many cloud provider networks only support 1500 MTU. Jumbo frames only work on end-to-end controlled L2 segments.

  2. Ignore the EMSGSIZE error in application code and continue sending 95% fail

    EMSGSIZE means the kernel refused to send the packet. The data was not transmitted. Ignoring the error leads to silent data loss and application-level failures.

Error Chain

Leads to:
Preceded by:
Frequently confused with: