Technology / Analysis & practical perspectives

Large Packets Dropped: Resolving MTU Mismatch and PMTU Black Holes

Troubleshooting stalled SSH sessions, failing SCP file transfers, and frozen TLS handshakes over VXLAN, WireGuard, and GRE tunnels; enforcing MSS clamping instead of arbitrary NIC edits.

Ardeshir Daryani·5 November 2026·2 min read

Schematic 3D rendering of network packets traversing an MTU boundary sizing gate in a cyber tunnel without vendor emblems. — An original AI-generated conceptual illustration; not an accurate depiction of a commercial product or architecture.

A classic dilemma frequently encountered by network engineers: ICMP echo requests (ping) succeed with single-digit round-trip times, small HTTP requests load instantly, yet the moment a user initiates an SSH login, SCP transfer, or heavy TLS handshake, the connection freezes indefinitely and aborts with a timeout.

The initial misstep is often arbitrarily decreasing the MTU on local user adapters or blaming physical ISP link quality.

Root Cause: Path MTU Discovery (PMTU) Black Hole

Standard Ethernet frames permit a Maximum Transmission Unit (MTU) of 1500 bytes. When traffic traverses an encrypted or encapsulated overlay tunnel (such as WireGuard, GRE, IPsec, or VXLAN), tunnel headers consume between 20 and 80 bytes of payload space.

Clients transmit packets with the Don't Fragment (DF) bit enabled. If intermediate routers or edge firewalls drop ICMP Type 3 Code 4 messages (Destination Unreachable, Fragmentation Needed), the transmitting host never learns that its packets exceed path capacity. Large packets are silently dropped: this is the PMTU Black Hole.

3-Step Systematic Triage

Path Probing via DF-Flagged Ping: Determine the maximum unfragmented payload size:
- Windows:
```
ping 10.10.10.1 -f -l 1472
```
- Linux:
```
ping -M do -s 1472 10.10.10.1
```
Decrement payload size until packets pass cleanly without Packet needs to be fragmented errors. (Remember to account for the 28-byte IP/ICMP header).
Overlay Header Budgeting:
- Standard WireGuard implementations budget MTU to 1420 bytes.
- Standard VXLAN encapsulation requires an inner MTU of 1450 bytes unless physical fabrics support Jumbo Frames (9000 bytes).
Definitive Fix: TCP MSS Clamping at the Edge: Rather than modifying individual client devices, enforce MSS clamping on the boundary gateway or firewall so TCP SYN negotiation automatically respects the bottleneck:
```
iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
```

Conclusion

When ping succeeds but substantial payload transfers lock up, focus triage on encapsulation overhead and blocked ICMP controls. Enforcing MSS clamping at the perimeter permanently resolves the bottleneck globally.

Technology analysis for more informed decisions.All posts →