# ICMP: Frag needed but DF set for packet size 1500 on vlan100

- **ID:** `networking/vlan-mtu-mismatch`
- **Domain:** networking
- **Category:** network_error
- **Error Code:** `EMSGSIZE`
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

A packet with the Don't Fragment (DF) flag set exceeds the MTU of a VLAN interface (e.g., 1400 due to QinQ or MPLS overhead), causing the router to send an ICMP Fragmentation Needed message, but the sender ignores it, leading to a black hole.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| Linux kernel 5.10-6.8 | active | — | — |
| Cisco IOS XE 17.x | active | — | — |
| Juniper Junos 21.x-23.x | active | — | — |
| Nginx 1.24-1.26 | active | — | — |
| HAProxy 2.8-3.0 | active | — | — |

## Workarounds

1. **Reduce the TCP MSS on the server to account for VLAN overhead: run `ip link set dev eth0 mtu 1400` on the server, then adjust MSS clamping via iptables: `iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu`** (85% success)
   ```
   Reduce the TCP MSS on the server to account for VLAN overhead: run `ip link set dev eth0 mtu 1400` on the server, then adjust MSS clamping via iptables: `iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu`
   ```
2. **Configure MSS clamping on the router for the VLAN: on Cisco, `ip tcp adjust-mss 1360` on the VLAN interface; on Linux, use `ebtables` or `iptables` to rewrite MSS.** (80% success)
   ```
   Configure MSS clamping on the router for the VLAN: on Cisco, `ip tcp adjust-mss 1360` on the VLAN interface; on Linux, use `ebtables` or `iptables` to rewrite MSS.
   ```
3. **Increase the MTU on the entire path (e.g., set jumbo frames on switches and routers) if the infrastructure supports it, but verify end-to-end consistency.** (70% success)
   ```
   Increase the MTU on the entire path (e.g., set jumbo frames on switches and routers) if the infrastructure supports it, but verify end-to-end consistency.
   ```

## Dead Ends

- **Increasing MTU on the VLAN interface to 1500 without adjusting underlying physical links** — The physical path (e.g., MPLS or QinQ) adds headers, so the actual MTU remains lower; increasing VLAN MTU alone causes fragmentation at lower layers or silent drops. (85% fail)
- **Disabling DF flag on all TCP packets using iptables rules** — Many applications (e.g., NFS, IPsec) require DF for PMTUD; disabling it can cause path MTU discovery failure and performance degradation. (70% fail)
- **Ignoring the error and assuming it's a transient network issue** — The error persists and causes intermittent timeouts for large-file transfers or streaming, leading to user complaints and retransmission storms. (90% fail)