How does fragmentation work in IPv6?
Show the answer
Say this first
Routers never fragment IPv6 packets. If a packet is too big for the next link, the router drops it and sends an ICMPv6 Packet Too Big (type 2) with the link MTU back to the source. The source lowers its path MTU for that destination and resends, fragmenting itself if it must, using a Fragment extension header. Every link must carry at least 1280 bytes. This makes Path MTU Discovery essential, so blocking Packet Too Big breaks connections.
Go deeper
The Fragment header (8 bytes)
| Field | Bits |
|---|---|
| Next Header | 8 |
| Reserved | 8 |
| Fragment Offset (8-byte units) | 13 |
| Reserved | 2 |
| M (more fragments) | 1 |
| Identification | 32 |
The Identification field is 32 bits, against 16 in IPv4, so it wraps much more slowly.
Rules worth quoting
- Minimum link MTU is 1280 bytes. A host that never wants to think about PMTUD can send 1280-byte packets.
- Path MTU Discovery is RFC 8201. Packet Too Big messages are sent even in reply to multicast.
- Overlapping fragments must be dropped (RFC 5722).
- The first fragment must hold the whole header chain up to the upper layer (RFC 7112).
- Atomic fragments (a Fragment header on an unfragmented packet) are deprecated (RFC 8021).
Where it hurts
- PMTUD black holes: a firewall drops Packet Too Big, the source keeps sending full-size packets, and the session hangs after the handshake.
- Tunnels: a 6in4 tunnel over a 1500-byte IPv4 path carries 1480 bytes of IPv6; GRE carries 1476.
- Large UDP: DNS answers that need fragments are often dropped. DNS Flag Day 2020 recommended an EDNS buffer of 1232 bytes, which is 1280 minus the 40-byte IPv6 and 8-byte UDP headers.
Mitigations
interface Tunnel0
ipv6 mtu 1400
ipv6 tcp adjust-mss 1340MSS clamping hides the problem for TCP. Letting Packet Too Big through fixes it for everything.
They will ask next
Why did IPv6 move fragmentation to the source?
Fragmenting costs routers CPU and complicates hardware. Making the source responsible keeps the forwarding path simple and pushes hosts to send the right size from the start.
Why is the MSS 1340 in that example?
IPv6 MTU 1400 minus 40 bytes of IPv6 header and 20 bytes of TCP header gives 1340.
Traps
- Saying routers fragment IPv6 if DF is not set. There is no DF bit; routers never fragment.
- Filtering ICMPv6 Packet Too Big at the firewall.