EMSGSIZE networking network_error ai_generated partial

ICMP：需要分片但设置了DF标志，数据包大小1500，VLAN100

ICMP: Frag needed but DF set for packet size 1500 on vlan100

ID: networking/vlan-mtu-mismatch

其他格式: JSON · Markdown 中文 · English
80%修复率
85%置信度
1证据数
2024-03-15首次发现

版本兼容性

版本状态引入弃用备注
Linux kernel 5.10-6.8 active — — —
Cisco IOS XE 17.x active — — —
Juniper Junos 21.x-23.x active — — —
Nginx 1.24-1.26 active — — —
HAProxy 2.8-3.0 active — — —

根因分析

设置了不分片（DF）标志的数据包超过了VLAN接口的MTU（例如由于QinQ或MPLS开销导致MTU为1400），路由器发送ICMP需要分片消息，但发送方忽略该消息，导致通信黑洞。

English

A packet with the Don't Fragment (DF) flag set exceeds the MTU of a VLAN interface (e.g., 1400 due to QinQ or MPLS overhead), causing the router to send an ICMP Fragmentation Needed message, but the sender ignores it, leading to a black hole.

generic

官方文档

https://datatracker.ietf.org/doc/html/rfc1191

解决方案

  1. Reduce the TCP MSS on the server to account for VLAN overhead: run `ip link set dev eth0 mtu 1400` on the server, then adjust MSS clamping via iptables: `iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu`
  2. Configure MSS clamping on the router for the VLAN: on Cisco, `ip tcp adjust-mss 1360` on the VLAN interface; on Linux, use `ebtables` or `iptables` to rewrite MSS.
  3. Increase the MTU on the entire path (e.g., set jumbo frames on switches and routers) if the infrastructure supports it, but verify end-to-end consistency.

无效尝试

常见但无效的做法:

  1. Increasing MTU on the VLAN interface to 1500 without adjusting underlying physical links 85% 失败

    The physical path (e.g., MPLS or QinQ) adds headers, so the actual MTU remains lower; increasing VLAN MTU alone causes fragmentation at lower layers or silent drops.

  2. Disabling DF flag on all TCP packets using iptables rules 70% 失败

    Many applications (e.g., NFS, IPsec) require DF for PMTUD; disabling it can cause path MTU discovery failure and performance degradation.

  3. Ignoring the error and assuming it's a transient network issue 90% 失败

    The error persists and causes intermittent timeouts for large-file transfers or streaming, leading to user complaints and retransmission storms.