How does Path MTU Discovery work, and what is a PMTUD black hole?
Show the answer
Say this first
The sender sets the Don't Fragment bit on its packets. A router that cannot forward a packet because the next link's MTU is smaller drops it and sends back ICMP type 3 code 4, "fragmentation needed and DF set", with the next-hop MTU. The sender lowers its packet size for that destination and resends. In IPv6 the message is ICMPv6 Packet Too Big, and routers never fragment. A black hole happens when that ICMP message never reaches the sender, usually because a firewall drops all ICMP. Small packets work, large ones vanish, and connections hang as soon as a full-size segment is needed.
Go deeper
Symptoms that shout MTU
- Ping works, the TCP handshake works, small requests work.
- Large transfers stall: web pages load partly, SSH logs in but a long directory listing hangs, file copies freeze at the first big read.
- TLS handshakes stall when the server sends its certificate chain, the first large packet.
- One direction works and the other does not (uploads fine, downloads hang).
How I test from Linux
ping -M do -s 1472 -c 3 10.30.0.10
ping -M do -s 1448 -c 3 10.30.0.10
tracepath -n 10.30.0.101472 + 8 ICMP + 20 IP = 1,500. If 1,472 fails with no "Frag needed" message and a smaller size works, something is dropping packets above the real path MTU and the ICMP is not coming back.
Fixes, best first
- Permit ICMP type 3 code 4 (and ICMPv6 type 2) through every firewall and ACL in the path.
- Clamp the TCP MSS where the MTU shrinks, such as tunnel interfaces (
ip tcp adjust-mss). - Set a correct
ip mtuon tunnels so the router itself sends a correct ICMP message. - Enable packetization layer PMTUD on hosts (
net.ipv4.tcp_mtu_probing=1on Linux), which probes with smaller segments when it detects a black hole instead of relying on ICMP.
Clearing the DF bit on a router makes TCP work by forcing fragmentation, which costs CPU and can break under load. It also cannot help IPv6.
They will ask next
Why does the TCP handshake succeed when the path MTU is broken?
SYN, SYN-ACK and ACK are around 60 bytes. Only full-size data segments exceed the smaller MTU, so the failure shows up after the connection is established.
Where does the sender keep what it learned?
In a per-destination cache. On Linux,
ip route get 10.30.0.10showscache expires ... mtu 1476after an ICMP message has been received; entries expire after 10 minutes by default.Why must IPv6 firewalls never drop Packet Too Big?
IPv6 routers do not fragment, so PMTUD is the only way a sender learns a smaller MTU. Blocking ICMPv6 type 2 creates black holes for every path with a smaller link.
Traps
- Blocking all ICMP "for security". Type 3 code 4 and ICMPv6 type 2 are needed for the network to work.