What is PMTUD?

PMTUD (Path MTU Discovery) is the method a host uses to find the largest packet that can cross the whole path to a destination without being fragmented.

Every link has its own MTU, and the smallest one along a path is the path MTU. With PMTUD, the sender transmits packets with the Don't Fragment bit set, starting at its own interface MTU. If a router along the way can't forward a packet that big, it drops it and sends back an ICMP message saying so, including the MTU it can handle: Destination Unreachable, type 3 code 4 "fragmentation needed" for IPv4 (RFC 1191), or ICMPv6 Packet Too Big for IPv6 (RFC 8201). The sender caches the smaller size for that destination and resends. In IPv6 this is the only way it works, because routers never fragment. TCP uses the result to size its segments.

The weak point is that it depends on those ICMP messages arriving. If a firewall drops ICMP wholesale, the sender never learns the limit and keeps retransmitting packets that can't get through: an MTU black hole. The symptoms are distinctive: pings and small requests work, a TCP connection opens, then large transfers or page loads hang. It is common on paths with tunnels, PPPoE or VPNs, where the MTU drops below 1500. The fixes are to stop filtering the ICMP that PMTUD needs and, on routers, to clamp the TCP MSS so TCP never sends segments that won't fit. Some stacks can also probe the path size without relying on ICMP, known as packetization-layer PMTUD. The Packets That Never Come Back lesson recreates an MTU black hole on a VyOS router and fixes it.