The MTU is the largest IP packet a link can carry without requiring fragmentation at that layer. Ethernet commonly supports an IP MTU of 1500 bytes, but tunnels, PPPoE, VPNs, and other encapsulation add overhead and may require a smaller effective packet size. TCP MSS is related but different: it describes the maximum TCP payload a host is willing to receive in one segment, leaving room for IP and TCP headers.

Packet size can fail where small probes succeed

Path MTU Discovery is intended to let endpoints learn the largest packet that can traverse the entire path. Problems appear when a tunnel reduces MTU and the network blocks or mishandles the control messages needed to adjust. Small packets may work while large HTTPS transfers, VPN traffic, uploads, or specific websites stall. This is sometimes called a PMTUD black-hole symptom.

A VPN works for small requests but stalls on transfers

A PPPoE connection adds overhead that can make a 1500-byte LAN packet too large for the WAN path unless the network handles it correctly. Browsing a simple page may succeed, while a VPN or specific TLS session hangs on larger packets. Correct MTU/MSS handling fixes the packet-size mismatch; changing DNS would not.

Compare transfer sizes and tunnel paths

  • Establish whether the problem affects all traffic or primarily large transfers/tunneled paths.
  • Check whether PPPoE, WireGuard/OpenVPN/IPsec, GRE, or another encapsulation changed the effective path MTU.
  • Use controlled ping tests with the “do not fragment” behavior where the operating system supports it, accounting for header size.
  • Inspect router/VPN settings for MTU and TCP MSS clamping; change them only with a clear reason.
  • Ensure firewalls do not indiscriminately block ICMP messages required for proper path behavior, especially in IPv6 where fragmentation rules differ.
  • Retest both TCP and non-TCP applications after any change.

Path MTU discovery and TCP MSS

Lowering MTU blindly can mask a path problem but also reduces efficiency. MSS clamping is commonly used at routers to advertise a smaller TCP payload across a constrained tunnel, but it does not fix every protocol because it applies to TCP. IPv6 places even more importance on correct Path MTU Discovery because routers do not fragment forwarded IPv6 packets in the IPv4 style.

Avoid assuming every stalled transfer is DNS

  • Setting MTU to a random low number from a forum without measuring the path.
  • Confusing MTU with internet speed or Wi-Fi channel width.
  • Blocking all ICMP for “security” and then breaking path discovery.
  • Assuming MSS clamping fixes UDP-based protocols.

Is 1500 always the correct MTU?

No. It is common on Ethernet, but tunnels and access technologies can reduce effective path MTU.

Is MSS the same as MTU?

No. MSS is a TCP payload value; MTU is a link/network packet-size limit.

Can MTU problems affect only some websites?

Yes, especially when paths, packet sizes, and PMTUD behavior differ.

Should I block ICMP?

Broad ICMP blocking can break legitimate network functions. Use protocol-aware firewall policy rather than assuming all ICMP is harmful.