What is MTU?
Maximum Transmission Unit
The MTU (Maximum Transmission Unit) is the largest packet, in bytes, that an interface can send in one piece without it having to be fragmented.
On Ethernet the standard MTU is 1500 bytes. That counts the IP packet, including its IP and TCP or UDP headers, but not the 14-byte Ethernet header or the frame check sequence. Many data-centre networks use jumbo frames with an MTU around 9000 bytes. Every tunnel or encapsulation adds headers and so leaves less room for the inner packet: PPPoE commonly gives 1492, WireGuard defaults to 1420, and VXLAN adds 50 bytes, so the underlay needs a larger MTU to carry 1500-byte frames. The smallest MTU along a path is the path MTU, and that is what limits end-to-end packet size. An IPv4 router can fragment a packet that is too big unless its Don't Fragment bit is set; IPv6 routers never fragment, and every IPv6 link must support at least 1280 bytes.
MTU problems are among the most confusing faults because small packets work and only large ones fail. Pings succeed and SSH logs in, but web pages or file transfers stall. That pattern usually means Path MTU Discovery is broken because ICMP is being filtered, and the usual router-side fix is clamping the TCP MSS. In routing protocols, both ends of a link must agree: an MTU mismatch leaves OSPF neighbours stuck in ExStart or Exchange, because the database exchange packets from one side are too big for the other. When testing, send pings with Don't Fragment set at increasing sizes (ping -M do -s 1472 on Linux tests a 1500-byte packet). The Packets That Never Come Back lesson diagnoses an MTU black hole, and Site-to-site VPN with WireGuard on VyOS shows a tunnel's smaller MTU in action.
Lessons that use MTU
- Packets That Never Come BackIntermediate · 75 min
Advanced packet capture with tcpdump, and how to find where packets die on a VyOS network: missing NAT and return routes, asymmetric routing through a stateful firewall, and MTU black holes, all diagnosed on a real VyOS router.
- Site-to-site VPN with WireGuard on VyOSIntermediate · 35 min
Join two sites' private LANs across the internet with WireGuard on VyOS: keys and peers, the AllowedIPs mistake and what it teaches, what the internet actually sees, and the tunnel's smaller MTU.
- OSPF FundamentalsBeginner · 70 min
The link-state IGP that runs inside most networks: neighbour adjacencies, LSA flooding, SPF, costs, DR/BDR, areas and LSA types, a hands-on FRR lab, and how OSPF underpins BGP.
- OSPF on VyOS: costs and OSPFv3Intermediate · 30 min
OSPF the VyOS way: interface-based configuration, reading the interface and database output, steering traffic with costs (and the asymmetric routing that follows), and OSPFv3 for IPv6 over link-local addresses. Captured on the three-router edge/core lab.
- EVPN and VXLAN: layer 2 over a routed fabricAdvanced · 45 min
Stretch a layer-2 segment across a routed leaf-spine fabric: VXLAN for the data plane, BGP EVPN for the control plane. Built with FRR: the underlay, VNIs, type-2 and type-3 routes, route targets, and the VXLAN packets on the wire.
- IPv6 on VyOS: setup and routingBeginner · 55 min
Number a site from an ISP's /48 on VyOS: WAN and blackhole routes, SLAAC with Router Advertisements, handing a /56 to a downstream router statically and with DHCPv6 prefix delegation, and the forward firewall IPv6 needs because there's no NAT. Every output comes from a real two-router VyOS lab.
- Debugging BGP: every session state, reproducedIntermediate · 60 min
Break a working BGP lab a dozen ways and learn to read each failure: Idle, Connect, Active and OpenSent, max-prefix, firewalls, wrong AS, TTL, hold timers, missing policy and unreachable next hops, all with real FRR output and packet captures.
- Linux Network ConnectivityBeginner · 80 min
Find out why a Linux machine can't reach something, layer by layer: interfaces and addresses, routes and ip route get, ARP and the neighbour table, ping and traceroute, DNS, and listening sockets — with real output from a three-host lab.