Path MTU Discovery
Path MTU discovery online: binary-search the largest unfragmented packet to any host using DF-set ICMP probes, and get the path MTU, the matching TCP MSS and a likely cause.
About Path MTU Discovery
Path MTU Discovery finds the largest packet that can cross the network between our probe host and your target without being fragmented. It sends ICMP echo requests with the Don't-Fragment bit set and binary-searches between 1200 and 1500 bytes until it settles on the boundary, then reports the path MTU, the full probe sequence with each size that passed or was dropped, and the TCP MSS that matches. When the answer is below 1500 it names the most likely cause instead of leaving you to guess.
The mechanism is the one described in RFC 1191 for IPv4 and RFC 8201 for IPv6: a router that cannot forward an oversized packet with DF set drops it and returns ICMP type 3 code 4, Fragmentation Needed, carrying the next-hop MTU. The failure mode is a PMTUD black hole. If a firewall or overzealous ACL filters those ICMP messages, the sender never learns to shrink its packets: small requests and TLS handshakes succeed, then large responses vanish and connections hang partway through a transfer.
Probes leave from our own European infrastructure, so the figure is the path MTU from an EU network to your host and not from your laptop behind the very tunnel you are trying to diagnose. Sizes are reported as the total IPv4 packet, payload plus 28 bytes of IP and ICMP header, which is the figure an interface MTU is set to; ping -s counts only the payload, 28 bytes less. A result around 1400 to 1420 usually means an IPsec or WireGuard tunnel, while the 1470s and 1480s point at GRE, IP-in-IP or PPPoE.
How to use it
- 1Enter the hostname or IP address of the target, for example example.eu.
- 2Select Discover path MTU and wait while the DF-set ICMP probes run.
- 3Read the path MTU in bytes, along with the IP address that was actually probed.
- 4Work through the probe sequence to see which packet sizes passed and which were dropped.
- 5Read the diagnosis note when the value is below 1500 to see the likely cause, such as a tunnel or PPPoE.
- 6Apply the suggested interface or tunnel MTU and the matching TCP MSS on your own equipment.
Common use cases
- -Troubleshooting a VPN where small pings succeed but large transfers and TLS handshakes stall.
- -Confirming the usable MTU across a new IPsec, WireGuard or GRE tunnel before putting production traffic on it.
- -Diagnosing a site that loads its HTML but hangs on large assets, the classic PMTUD black hole.
- -Choosing the right TCP MSS clamp value on a router or firewall instead of guessing 1400.
- -Verifying that a path still carries a full 1500-byte packet after an ISP or transit change.
Frequently asked questions
- What is path MTU discovery?
- It is the mechanism from RFC 1191, and RFC 8201 for IPv6, by which a sender finds the largest packet a path accepts without fragmentation. The sender marks packets Don't-Fragment; any router that cannot forward one drops it and returns an ICMP Fragmentation Needed message giving its next-hop MTU, and the sender reduces its packet size accordingly.
- Why is my path MTU 1400 instead of 1500?
- Something on the path is adding encapsulation, and the overhead comes straight out of Ethernet's 1500 bytes. IPsec and WireGuard commonly leave 1400 to 1420, GRE 1476, IP-in-IP 1480, and PPPoE 1492 before anything else is stacked on top. Measure it rather than guessing, then set your tunnel MTU and MSS clamp to the measured value.
- What is a PMTUD black hole?
- It is what happens when the ICMP Fragmentation Needed messages path MTU discovery depends on are filtered by a firewall or a router ACL. The sender never learns to reduce its packet size, so small packets get through while large ones are silently dropped: connections open, TLS handshakes complete, then a big response hangs. Clamping TCP MSS at the tunnel edge is the usual workaround.
- How do I calculate TCP MSS from the MTU?
- Subtract 40 bytes for IPv4: 20 for the IP header and 20 for the TCP header, so a 1500-byte MTU gives an MSS of 1460 and a 1420-byte tunnel MTU gives 1380. IPv6 uses a 40-byte fixed header, so subtract 60. Timestamps and other TCP options consume space inside the segment, so the usable payload can be a little less.