MTU/MSS - Finding the best settings
Overview
The internet is connected with a vast range of technologies and therefore have different characteristics regarding speed, throughput and bandwidth. The different technologies making up the link may include Ethernet, PPPoE, Frame Relay or ATM; each with their own largest packet size—Maximum Transmission Unit (MTU).
Typical sizes include 1500 for Ethernet or 9202 for Ethernet with Jumbo Frames, 1492 for PPPoE, and 2304 for WLAN.
If a packet is larger then the MTU of the technology used, then fragmentation must occur. This is when the packet is split up into smaller packets so they are smaller then the MTU. Larger MTU’s reduce fragmentation, however, over a larger network where packet loss is susceptible, larger packets require larger re-transmissions as opposed to a small packet being dropped only requiring a small packet being resent. Larger packets also increase system performance by reducing the number of packets processed during a transmission—often referred to by routers as Packets Per Second (PPS).
Typical Symptoms
- TCP time outs.
- SSH times out when connecting to some hosts.
- SCP times out but SSH works.
- Chat programs are randomly unable to send messages.
- SSL resolution fails when connecting to some domains. IE: http://packages.gitlab.com .
- Clients seeming to randomly hang.
- Partial loaded web pages.
PATH MTU Discovery
The Internet Protocol (IP) defines the path MTU as the smallest supported MTU by any of the hops between the source and destination of a connection.
When a host sends out a packet to a destination, it will choose the MTU of the very next hop as a starting point for MTU size. When that reaches it’s next destination, if the MTU is too large, the packet will be dropped with an ICMP response “fragmentation needed and DF bit set”. This is an important part of diagnosing MTU related issues—if your router or any other network drops ICMP packets, then MTU discovery will not work; this can be noticed by a lot of resent SYN packets. This process keeps occurring until the final destination is reached.
MSS Clamping
Some routers along the path of a transmission may fail to respond with the ICMP Destination Unreachable messages. This causes MTU discovery process to fail. Upper layer protocols will then keep sending larger packets, like TCP, and then eventually fail due to timeout.
TCP Maximum Segment Size (MSS) is a solution to this problem. This is used to indicate the maximum TCP segment size that can be accepted on that connection. This is sent from the data receiver to the data sender and indicates they can accept TCP segments up to size X. With MSS being a part of TCP, no ICMP traffic is needed to adjust the MTU between two hosts.
MSS counts only the data bytes; not the TCP or IP headers. Therefore the calculation is as follows:
MSS = MTU - sizeof(TCP Header) - sizeof(IP Header)
Finding the correct MTU
To discover the correct MTU, use ping with a specified packet size and keep reducing by 10 until success.
?You should set the MTU to this + 28 (IP Header).?
Windows
ping -n 1 -l 1500 -f www.example.com
Linux
ping -M do -s 1500 -c 1 www.example.com
MacOS
ping -D -v -s 1500 -c 1 www.example.com
Example
C:\Users\josep>ping -n 1 -l 1382 -f www.google.com
Pinging www.google.com [172.217.25.164] with 1382 bytes of data:
Packet needs to be fragmented but DF set.
Ping statistics for 172.217.25.164:
Packets: Sent = 1, Received = 0, Lost = 1 (100% loss),
C:\Users\josep>ping -n 1 -l 1372 -f www.google.com
Pinging www.google.com [172.217.25.164] with 1372 bytes of data:
Reply from 172.217.25.164: bytes=68 (sent 1372) time=25ms TTL=247
Ping statistics for 172.217.25.164:
Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 25ms, Maximum = 25ms, Average = 25ms