What is DF?

The DF (Don't Fragment) bit is an IPv4 header flag telling routers not to split the packet into fragments, even if it's too big for the next link.

The IPv4 header has a three-bit Flags field: one reserved bit, DF, and MF (More Fragments). Normally a router that receives a packet larger than the next link's MTU can fragment it and let the destination reassemble the pieces. With DF set, it can't. It drops the packet and should send an ICMP "Destination Unreachable, fragmentation needed and DF set" message (type 3, code 4) back to the sender, including the MTU of the link that was too small. The sender uses that to lower its packet size. This is the basis of Path MTU Discovery, and it's why most operating systems set DF on TCP traffic by default: fragmentation is slow and fragile, and finding the right size once is better.

The catch is that the whole scheme depends on the ICMP message getting back. If a firewall along the way blocks ICMP, the sender never learns, keeps sending packets that are silently dropped, and you get a "black hole": small requests and pings work, but large transfers or web pages hang. Tunnels such as VPNs, which reduce the usable MTU, are a frequent trigger. Clamping the TCP MSS on the tunnel router is the common workaround. On Linux, ping -M do -s <size> sends pings with DF set, which is a quick way to find the largest packet a path will carry. IPv6 has no DF bit because routers never fragment IPv6 at all; they always send an ICMPv6 Packet Too Big instead. The Packets That Never Come Back lesson diagnoses an MTU black hole on a real router.