MTU: The Largest Frame a Link Will Carry

The MTU (maximum transmission unit) is the largest packet a link can carry in one frame, 1500 bytes on standard Ethernet. When a packet reaches a link with a smaller MTU, an IPv4 router either splits it into fragments or drops it, depending on a flag in the IP header; an IPv6 router always drops it.

Picture a company that connects two offices through a VPN tunnel. Small requests work, but large file uploads hang halfway every time. The tunnel adds its own headers, so its usable MTU is a little under 1500, and full-size packets no longer fit. Nothing is rejected outright; the large packets just vanish.

The flag is DF, "do not fragment", one bit in the IPv4 header. Most modern systems set it on every packet, so that they can find the smallest MTU on the path rather than have routers fragment silently.

The ICMP reply is what makes the system work. ICMP (Internet Control Message Protocol) carries error reports between machines, and the "fragmentation needed" message in IPv4, or "packet too big" in IPv6, tells the sender the largest size the link accepts. The sender then sends smaller packets. This is path MTU discovery.

The trap is a firewall that blocks all ICMP as a security habit. The reports never arrive, the sender keeps sending full-size packets, and every one of them is dropped. Small packets get through, so connections open and short pages load, but anything large stalls. That is the hanging upload in the VPN example, and the fix is to allow those ICMP messages through, or lower the MTU on the tunnel.

IPv6 moved fragmentation off routers on purpose: fragments are costly to handle and easy to lose, so only the sender may fragment, and every IPv6 link must carry at least 1280 bytes.

So when small requests work and large ones hang, suspect the MTU and blocked ICMP before suspecting the application.