Fragmentation is not a transport problem

2026-10-28

Every few months somebody reports that a service "works on the laptop but not from the office". Nine times out of ten it is MTU discovery, and nine times out of ten the fix applied is to lower the interface MTU to 1400 and move on. That works, but it also hides the actual failure for another year.

The path MTU is discovered by ICMP "fragmentation needed" messages. If any hop on the path drops those messages — a firewall rule, a policy router, a tunnel that forgets to relay them — the sender never learns the packet is too large. With TCP, the connection stalls on the first full-size segment and then recovers slowly or not at all.

The reliable diagnostic is not ping -M do. It is capturing the SYN and looking at the MSS the client advertises, then comparing it against what the server actually sends:

tcpdump -ni eth0 'tcp[tcpflags] & tcp-syn != 0 and port 443' -c 5

If the client advertises 1460 and the server immediately sends a 1500-byte frame into a 1420-byte path, you have found it. Clamp the MSS at the edge, do not just lower the MTU on one host.