highAdvancedSymptom-first#pmtu#mtu#blackhole#fragmentation#df-bit

PMTU blackhole -- large packets silently dropped due to Path MTU Discovery failure

Small HTTP requests succeed but large responses or file transfers hang or fail

Likely source:connectivityperformance

Focused incident mode — strips away everything but this runbook.

Symptoms

  • Small HTTP requests succeed but large responses or file transfers hang or fail
  • ping works but curl with large payloads times out
  • Connections hang when data exceeds ~1400 bytes but work for small payloads

PMTU blackholes are common with VPNs, cloud VPCs, and when firewalls block ICMP. The DF bit prevents fragmentation, so if ICMP 'need to fragment' is blocked, the sender never knows to reduce packet size.

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Path MTU to the destination

    tracepath -n <HOST> || ping -M do -s 1472 <HOST>

  • Interface MTU settings

    ip link show | grep mtu

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • Large packets fail but small ones work
  • traceroute with DF bit hangs at a specific hop
  • Firewall has a rule blocking ICMP type 3 code 4

Confirm before fixing

traceroute -n -M do -p 443 <HOST>
READ

Trace the path to find where DF-bit packets are blocked

Fix

echo 'Allow ICMP type 3 (Destination Unreachable) code 4 (Fragmentation Needed) through the firewall.'
READ

Document the ICMP allow rule

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
ping -M do -s 1472 <HOST>
READ

Test path MTU with DF bit

2
tracepath -n <HOST>
READ

Automatically discover the path MTU

3
ip link show | grep mtu
READ

Check local interface MTU

4
ip link set <INTERFACE> mtu 1500
CHANGE

Fix the MTU if it is misconfigured

Prevention

  • Always allow ICMP 'Fragmentation Needed' (type 3, code 4) through all firewalls.
  • Set TCP MSS clamping on VPNs and tunnels to avoid PMTU issues.
  • Test large-packet transfers (scp, rsync) through all network paths before going live.
  • Monitor for connections that hang after initial handshake (classic PMTU blackhole symptom).

Related runbooks

Same stack, same failure family — worth a skim.

Offload corruption -- TSO/GSO/ring buffer corrupting frames, causing retransmissionshigh

High TCP retransmissions but mtr shows no packet loss on the path

NetworkingProductionUSE3 causes
Open runbook
High SYN retransmissions -- packet loss on the network pathhigh

netstat shows high RetransSegs counter increasing rapidly

NetworkingAdvancedUSE3 causes
Open runbook
IPv6 network unreachable -- IPv6 disabled or broken, app binds IPv6 onlyhigh

'connect: Network is unreachable' when the app tries to connect via IPv6

NetworkingIntermediate4 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.