MTU · XB Field Notes

MSS clamping can repair one TCP path without repairing its MTU feedback

Sun, 24 Jan 2027 00:00:00 +0000

TCP’s Maximum Segment Size option advertises the receiving endpoint’s maximum TCP data size under the option’s defined accounting rules. Each direction has its own advertisement; the two values need not match. A router can reduce those advertisements while forwarding SYN messages so later data segments fit a constrained path. That changes TCP behavior for the affected connections, not the underlying link MTU itself.

Clamping changes TCP advertisements for new connections. It leaves the link MTU and missing ICMP feedback unchanged; preserve smaller peer limits and verify each direction.

When it breaks

An intermediate bottleneck can be smaller than either endpoint interface. If classic path-MTU feedback is filtered, a connection may establish successfully and then stall on larger data. Reducing MSS can help that TCP flow avoid the oversized packets, but the missing feedback remains missing. Treating the workaround as a complete network repair leaves other protocols and traffic patterns exposed to the original limitation.

MSS is not the full IP packet size. For an IPv4 path MTU of 1280 with ordinary twenty-byte IPv4 and TCP base headers, an advertised MSS of 1240 follows the basic calculation. Actual IP or TCP options require additional allowance when forming data segments. Confusing the advertisement with a final wire-packet length can make a seemingly conservative value too large.

Direction and timing matter too. Editing only one SYN direction leaves the other endpoint’s advertisement unchanged. Updating a rule does not rewrite options already exchanged by existing connections. A clamp should reduce an excessive advertisement, not raise a peer’s already smaller limit. Scope such policy to the real bottleneck and relevant flow instead of treating one hard-coded value as suitable for every network.

Check it quickly

Save this as check-mss-clamp.py and run python3 check-mss-clamp.py with Docker. The disposable environment uses Python 3.11.16, iproute2 6.1.0, nftables 1.0.6, and tcpdump 4.99.3, tested on Linux 6.12.76. NET_ADMIN and SYS_ADMIN enable four nested namespaces. Endpoint links have MTU 1500; the link between two routers has MTU 1280:

The environment and numerical outcomes below are inherited article reports, not independently reproduced here. The image does not pin the host kernel or package availability.

Startup retains unbuffered diagnostic and listening lines before checking readiness; synthetic tests leave actual pipe, process and capture behavior unverified.

from pathlib import Path
from tempfile import TemporaryDirectory
import subprocess,json,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 iputils-ping=3:20221126-1+deb12u1 nftables=1.0.6-2+deb12u2 tcpdump=4.99.3-1 traceroute=1:2.1.2-1 procps=2:4.0.2-3 && rm -rf /var/lib/apt/lists/*\nCMD ["python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,os,re,select,signal,subprocess,time
def run(*args,check=True,input=None,timeout=8):
 result=subprocess.run(args,input=input,capture_output=True,text=True,timeout=timeout)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def ns(name,*args,**kwargs):return run('ip','netns','exec',name,*args,**kwargs)
def ip(name,*args,**kwargs):return ns(name,'ip',*args,**kwargs)
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=2)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=2)
def spawn(stack,command):
 process=subprocess.Popen(command,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process);return process
def line(process,timeout=3):
 assert select.select([process.stdout],[],[],timeout)[0],'child response deadline exceeded'
 value=process.stdout.readline();assert value,process.stderr.read();return value
@contextmanager
def lab():
 with TemporaryDirectory(prefix='mtu-path-') as directory,ExitStack() as stack:
 root=Path(directory);proc=root/'proc';proc.mkdir();run('mount','-t','proc','proc',str(proc));stack.callback(run,'umount',str(proc))
 for name in ['client','r1','r2','target']:
 run('ip','netns','add',name);stack.callback(run,'ip','netns','delete',name,check=False);ip(name,'link','set','lo','up')
 def setting(name,key,value):
 assert name in ['client','r1','r2','target']
 path=proc/'sys'/key.replace('.','/')
 ns(name,'python3','-c',f'from pathlib import Path; p=Path({str(path)!r});p.write_text({str(value)!r});assert p.read_text().strip()=={str(value)!r}')
 yield root,stack,setting
def topology(setting,ipv6=False):
 links=[('client','c0','r1','a0',1,2,1,1500),('r1','a1','r2','b0',2,1,2,1280),('r2','b1','target','t0',3,1,2,1500)]
 for left,left_if,right,right_if,network,left_host,right_host,mtu in links:
 run('ip','link','add',left_if,'type','veth','peer','name',right_if)
 for name,interface,host in [(left,left_if,left_host),(right,right_if,right_host)]:
 run('ip','link','set',interface,'netns',name);ip(name,'link','set',interface,'mtu',str(mtu))
 address=f'2001:db8:{network}::{host}/64' if ipv6 else f'10.210.{network}.{host}/30'
 ip(name,'addr','add',address,'dev',interface,*(['nodad'] if ipv6 else []));ip(name,'link','set',interface,'up')
 family='-6' if ipv6 else '-4'
 for name in ['r1','r2']:setting(name,'net.ipv6.conf.all.forwarding' if ipv6 else 'net.ipv4.ip_forward',1)
 routes=[('client','default','2001:db8:1::1' if ipv6 else '10.210.1.1'),('target','default','2001:db8:3::1' if ipv6 else '10.210.3.1'),
 ('r1','2001:db8:3::/64' if ipv6 else '10.210.3.0/30','2001:db8:2::2' if ipv6 else '10.210.2.2'),
 ('r2','2001:db8:1::/64' if ipv6 else '10.210.1.0/30','2001:db8:2::1' if ipv6 else '10.210.2.1')]
 for name,destination,gateway in routes:ip(name,family,'route','add',destination,'via',gateway)
 if ipv6:
 deadline=time.monotonic()+4
 while any('tentative' in ip(name,'-6','address','show').stdout for name in ['client','r1','r2','target']):
 assert time.monotonic()<deadline,'IPv6 link-local DAD did not finish';time.sleep(.02)
def nft(name,script):return ns(name,'nft','-f','-',input=script)
def counters(name):
 result={}
 for item in json.loads(ns(name,'nft','-j','list','ruleset').stdout)['nftables']:
 rule=item.get('rule',{})
 if 'comment' in rule:
 for expression in rule['expr']:
 if 'counter' in expression:result[rule['comment']]=expression['counter']['packets']
 return result
class DeadlineLines:
 def __init__(self,read_chunk,wait_readable,now,limit=65536):
 self.read_chunk=read_chunk;self.wait_readable=wait_readable;self.now=now
 self.pending=bytearray();self.eof=False;self.limit=limit
 def read(self,timeout):
 deadline=self.now()+timeout
 while True:
 end=self.pending.find(b'\n')
 if end>=0:
 if end+1>self.limit:raise ValueError('child status line too long')
 value=bytes(self.pending[:end+1]);del self.pending[:end+1]
 return value.decode('utf-8')
 if len(self.pending)>self.limit:raise ValueError('child status line too long')
 if self.eof:raise EOFError(('child status EOF before newline',bytes(self.pending[:160])))
 remaining=deadline-self.now()
 if remaining<=0 or not self.wait_readable(remaining):
 raise TimeoutError('child status deadline exceeded; this is not a TCP diagnosis')
 chunk=self.read_chunk(4096)
 if not chunk:self.eof=True
 else:self.pending.extend(chunk)
def reader(stream):
 # Only use this with an unbuffered binary pipe, with no other reader.
 return DeadlineLines(stream.read,lambda timeout:bool(select.select([stream],[],[],timeout)[0]),time.monotonic)
def capture(stack,root,name,interface,expression,label):
 path=root/(label+'.pcap')
 process=subprocess.Popen(['ip','netns','exec',name,'tcpdump','--immediate-mode','-Z','root','-U','-n','-i',interface,'-w',str(path),expression],
 stdout=subprocess.DEVNULL,stderr=subprocess.PIPE,bufsize=0)
 stack.callback(process.stderr.close);stack.callback(stop,process);messages=reader(process.stderr)
 deadline=time.monotonic()+3
 while time.monotonic()<deadline:
 assert process.poll() is None,'tcpdump exited before listening'
 if 'listening on' in messages.read(max(0,deadline-time.monotonic())):return process,path
 raise AssertionError('tcpdump did not become ready')
def captured(process,path):
 process.send_signal(signal.SIGINT);_,diagnostic=process.communicate(timeout=3);assert process.returncode==0,diagnostic
 return run('tcpdump','-nn','-tt','-S','-r',str(path)).stdout

def advertisement(trace,source,destination,acknowledges):
 # This deliberately accepts only the pinned tcpdump IPv4 SYN display.
 prefix=re.compile(r'^\S+ IP '+re.escape(source)+r' > '+re.escape(destination)+r': Flags \[([^]]+)\], (.*)$')
 values=set()
 for row in trace.splitlines():
 match=prefix.fullmatch(row)
 if not match:continue
 flags,fields=match.groups()
 if 'S' not in flags:continue
 assert set(flags)<=set('S.EW') and ('.' in flags)==acknowledges,('unexpected SYN flags',row)
 assert '[|' not in row and '[bad' not in row,('incomplete SYN',row)
 seq=re.findall(r'(?:^|, )seq (\d+)(?=,|$)',fields)
 ack=re.findall(r'(?:^|, )ack (\d+)(?=,|$)',fields)
 options=re.findall(r'(?:^|, )options \[([^]]*)\](?=,|$)',fields)
 assert len(seq)==1 and len(ack)==int(acknowledges) and len(options)==1,('missing/ambiguous SYN fields',row)
 mss=re.findall(r'(?:^|,)mss (\d+)(?=,|$)',options[0])
 assert len(mss)==1 and re.search(r'(?:^|, )length 0$',fields),('invalid MSS or SYN payload',row)
 value=(int(seq[0]),int(ack[0]) if ack else None,int(mss[0]))
 assert 0<=value[0]<2**32 and (value[1] is None or 0<=value[1]<2**32),row
 assert 0<value[2]<=1240,('unclamped advertisement',row)
 values.add(value)
 assert len(values)==1,('missing or inconsistent handshake',source,destination,values)
 seq,ack,mss=values.pop()
 return {'source':source,'destination':destination,'seq':seq,'ack':ack,'mss':mss}
def verify_advertisements(target_trace,client_trace,port):
 client=f'10.210.1.2.{port}';target='10.210.3.2.18080'
 syn=advertisement(target_trace,client,target,False)
 synack=advertisement(client_trace,target,client,True)
 assert synack['ack']==(syn['seq']+1)%2**32,('unrelated SYN-ACK',syn,synack)
 return {'syn_at_target':syn,'synack_at_client':synack}



def server(stack):
 code=r'''
import socketserver,hashlib
class Handler(socketserver.StreamRequestHandler):
 def handle(self):
 self.request.settimeout(3)
 header=self.rfile.readline()
 if not header:return
 length=int(header);data=self.rfile.read(length)
 if len(data)!=length:return
 self.wfile.write(hashlib.sha256(data).hexdigest().encode()+b'\n');self.wfile.flush()
class Server(socketserver.ThreadingTCPServer):allow_reuse_address=True;daemon_threads=True
service=Server(('10.210.3.2',18080),Handler);print('ready',flush=True);service.serve_forever()
'''
 process=spawn(stack,['ip','netns','exec','target','python3','-u','-c',code]);assert line(process).strip()=='ready'
def transfer(size,port):
 code=r'''
import socket,json,hashlib,sys,struct
size=int(sys.argv[1]);stream=socket.socket();stream.settimeout(1.5);connected=False
try:
 stream.bind(('10.210.1.2',int(sys.argv[2])));stream.connect(('10.210.3.2',18080));connected=True
 stream.sendall(str(size).encode()+b'\n'+b'x'*size)
 with stream.makefile('rb') as incoming:reply=incoming.readline().decode().strip()
 assert reply==hashlib.sha256(b'x'*size).hexdigest()
 print(json.dumps({'ok':True,'connected':True,'bytes':size,'sha256':reply,'snd_mss':stream.getsockopt(socket.IPPROTO_TCP,socket.TCP_MAXSEG)}))
except OSError as error:
 stream.setsockopt(socket.SOL_SOCKET,socket.SO_LINGER,struct.pack('ii',1,0))
 print(json.dumps({'ok':False,'connected':connected,'type':type(error).__name__,'errno':error.errno}))
finally:stream.close()
'''
 return json.loads(ns('client','python3','-c',code,str(size),str(port)).stdout)
def hide_fragmentation_feedback():
 nft('r1','''table ip hidden_mtu {
 chain output { type filter hook output priority 0; policy accept;
 icmp type destination-unreachable icmp code frag-needed counter drop comment "fragmentation_feedback_dropped"
 }
}
''')
with lab() as (root,stack,setting):
 topology(setting);setting('client','net.ipv4.tcp_mtu_probing',0);server(stack);hide_fragmentation_feedback()
 failed=transfer(65536,40100);assert failed['connected'] and not failed['ok'] and failed['type']=='TimeoutError'
 initial_counter=counters('r1')['fragmentation_feedback_dropped'];assert initial_counter>0
 nft('r1','''table ip clamp {
 chain forward { type filter hook forward priority 0; policy accept;
 tcp flags & syn == syn tcp option maxseg size > 1240 tcp option maxseg size set 1240 counter comment "mss_rewritten"
 }
}
''')
 # Inspect each advertisement after forwarding, at its receiving endpoint.
 client_tap,client_path=capture(stack,root,'client','c0','tcp port 18080','mss-client')
 target_tap,target_path=capture(stack,root,'target','t0','tcp port 18080','mss-target')
 recovered=transfer(65536,40101);assert recovered['ok'] and recovered['snd_mss']<=1240,recovered
 client_trace=captured(client_tap,client_path);target_trace=captured(target_tap,target_path)
 advertisements=verify_advertisements(target_trace,client_trace,40101)
 after_transfer=counters('r1');assert after_transfer['mss_rewritten']>=2 and after_transfer['fragmentation_feedback_dropped']==initial_counter,after_transfer
 large_ping=ns('client','ping','-n','-M','do','-s','1400','-c','1','-W','1','10.210.3.2',check=False)
 assert large_ping.returncode!=0 and counters('r1')['fragmentation_feedback_dropped']>initial_counter
 print(json.dumps({'before_clamp':failed,'after_clamp':recovered,'counters_after_tcp':after_transfer,
 'icmp_echo_still_fails':{'returncode':large_ping.returncode,'stdout':large_ping.stdout,'stderr':large_ping.stderr},
 'advertisements':advertisements,'capture':{'client_c0':client_trace,'target_t0':target_trace}}))
"""
name='xbcatm-mtupath-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN','--cap-add','SYS_ADMIN','--memory','256m','--pids-limit','128',name,'python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The first router suppresses outgoing ICMP fragmentation-needed messages. The client disables its separate TCP MTU probing feature, making this a controlled classic-discovery failure. A 65536-byte transfer establishes TCP and then reaches its application deadline. The router counter confirms feedback was suppressed. The failed socket is aborted so its remaining retransmissions cannot be mistaken for packets from the later comparison.

The script adds a forwarding rule matching SYN-bearing TCP packets whose advertised MSS exceeds 1240. It sets that option to 1240 and counts the changes. SYN-ACK also has SYN set, so the rule covers the corresponding return advertisement. The comparison uses a fresh connection because an already established stream would retain the options it received during its own setup.

The revised assertions use fresh client port 40101, distinct from the failed connection’s 40100. Target-side capture checks SYN after forwarding; client-side capture checks returning SYN-ACK. Absolute sequence numbers link the acknowledgment to that SYN, and retransmissions cannot substitute for a missing direction. Both advertisements must be at most 1240. Aggregate counts alone remain insufficient. Synthetic traces test these checks; actual captures, one-sided-clamp failures and the full transfer still require authorized validation. The inherited report records a verified SHA-256 response, effective sending MSS 1228 after option overhead, and no additional fragmentation-feedback drops.

An IPv4 echo probe with a 1400-byte payload and Don’t Fragment set still fails afterward. The suppressed-feedback counter increases again. This larger ICMP packet is outside the TCP MSS mechanism: reducing an option in a TCP handshake did not shrink it or repair the router’s feedback policy. The paired outcomes define the workaround’s actual scope through traffic, not just a rule listing.

Keep the workaround tied to observed packet constraints

The local capture contains offload representations that can be larger than the resulting TCP segments and can carry apparent partial checksums. Do not conclude from those records alone that MSS was ignored or that giant packets crossed the 1280-byte link. The option, socket diagnostic, counters, and verified application response provide complementary evidence at different processing stages.

Derive a suitable bound from the actual encapsulation and IP version. An IPv6 outer header or additional tunnel overhead changes the packet budget, and path changes can invalidate a previously adequate fixed value. The rule in this isolated topology uses a known bottleneck; it is not a discovery algorithm that learns every later route change automatically.

After applying a production policy, test both new connections and relevant non-TCP traffic. Preserve peer advertisements that are already smaller, and inspect both directions when transfers differ by upload versus download. Prefer correcting required feedback and path configuration where possible. MSS adjustment is useful when its constrained role is explicit and the intended TCP exchange is actually verified.

Sources

RFC 6691 TCP Options and MSS, MSS advertisement and accounting for actual header options, checked 2026-09-12.
nftables packet-header mangling, editing MSS on SYN and SYN-ACK and directional advertisements, checked 2026-09-12.
RFC 1191 Path MTU Discovery, the underlying IPv4 discovery problem that clamping does not repair, checked 2026-09-12.
Linux segmentation offloads, local offload representations versus final TCP segments, checked 2026-09-12.
tcpdump 4.99.3 manual, numeric endpoints, absolute sequence numbers and SYN option display, checked 2026-10-19.
tcpdump 4.99.3 startup source, privilege-drop diagnostics precede the listening line, checked 2026-10-19.
Python 3.11 subprocess, unbuffered binary pipes and short reads, checked 2026-10-19.

Path MTU discovery can fail while handshakes and small requests still work

Sat, 14 Nov 2026 00:00:00 +0000

The path MTU is the smallest link MTU along a particular route. A sender cannot determine it solely from its own interface’s MTU because an intermediate link may carry smaller packets. Classic IPv4 Path MTU Discovery sends packets with Don’t Fragment set and uses ICMP fragmentation-needed feedback to reduce the estimated packet size. A working route and a working size estimate are separate requirements.

The smallest link governs packet fit. Compare feedback, fresh route state, effective MSS, and representative application delivery in the failing direction.

When it breaks

A tunnel or another constrained intermediate link can make large transfers fail while a TCP handshake and small request succeed. Their packets fit through the bottleneck, so those successes do not validate full-sized data. Repeatedly testing only a short ping or a tiny health response may therefore miss a path-MTU problem that affects uploads, larger responses, or sustained transfers.

Filtering the required ICMP feedback can create a black hole for oversized packets. The sender sees missing progress but lacks the classic signal identifying the smaller MTU. Other probing mechanisms may help, depending on transport and configuration; this is not proof that every TCP stack always hangs under such filtering. Identify which discovery or black-hole recovery mechanism is actually enabled before drawing conclusions.

Path information can also be cached. A test conducted after a successful discovery may behave differently from a fresh client, even after a firewall rule changes. Reusing that state can hide a broken feedback path. A route change or asymmetric return path complicates the picture further, so record direction, source, destination, and the conditions under which the estimate was learned.

Check it quickly

The exact namespace, packet-capture, and socket integration below was not rerun in this review. Its recorded observations remain historical; no offline check reproduces the network result.

The historical report used Linux 6.12.76, Python 3.11.16, iproute2 6.1.0, nftables 1.0.6 and tcpdump 4.99.3. Save this as check-path-mtu.py only for a separately authorized disposable Linux VM. Docker shares its kernel: NET_ADMIN, SYS_ADMIN, proc mounts and namespace settings require that isolation. The build downloads packages despite the later --network none run. Keep assertions enabled; do not relax host security if setup fails. New veth links and routes are intended to remain inside the lab:

from pathlib import Path
from tempfile import TemporaryDirectory
import subprocess,json,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 iputils-ping=3:20221126-1+deb12u1 nftables=1.0.6-2+deb12u2 tcpdump=4.99.3-1 traceroute=1:2.1.2-1 procps=2:4.0.2-3 && rm -rf /var/lib/apt/lists/*\nCMD ["python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,os,select,signal,subprocess,time
def run(*args,check=True,input=None,timeout=8):
 result=subprocess.run(args,input=input,capture_output=True,text=True,timeout=timeout)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def ns(name,*args,**kwargs):return run('ip','netns','exec',name,*args,**kwargs)
def ip(name,*args,**kwargs):return ns(name,'ip',*args,**kwargs)
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=2)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=2)
def spawn(stack,command):
 process=subprocess.Popen(command,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process);return process
def line(process,timeout=3):
 assert select.select([process.stdout],[],[],timeout)[0],'child response deadline exceeded'
 value=process.stdout.readline();assert value,process.stderr.read();return value
@contextmanager
def lab():
 with TemporaryDirectory(prefix='mtu-path-') as directory,ExitStack() as stack:
 root=Path(directory);proc=root/'proc';proc.mkdir();run('mount','-t','proc','proc',str(proc));stack.callback(run,'umount',str(proc))
 for name in ['client','r1','r2','target']:
 run('ip','netns','add',name);stack.callback(run,'ip','netns','delete',name,check=False);ip(name,'link','set','lo','up')
 def setting(name,key,value):
 assert name in ['client','r1','r2','target']
 path=proc/'sys'/key.replace('.','/')
 ns(name,'python3','-c',f'from pathlib import Path; p=Path({str(path)!r});p.write_text({str(value)!r});assert p.read_text().strip()=={str(value)!r}')
 yield root,stack,setting
def topology(setting,ipv6=False):
 links=[('client','c0','r1','a0',1,2,1,1500),('r1','a1','r2','b0',2,1,2,1280),('r2','b1','target','t0',3,1,2,1500)]
 for left,left_if,right,right_if,network,left_host,right_host,mtu in links:
 run('ip','link','add',left_if,'type','veth','peer','name',right_if)
 for name,interface,host in [(left,left_if,left_host),(right,right_if,right_host)]:
 run('ip','link','set',interface,'netns',name);ip(name,'link','set',interface,'mtu',str(mtu))
 address=f'2001:db8:{network}::{host}/64' if ipv6 else f'10.210.{network}.{host}/30'
 ip(name,'addr','add',address,'dev',interface,*(['nodad'] if ipv6 else []));ip(name,'link','set',interface,'up')
 family='-6' if ipv6 else '-4'
 for name in ['r1','r2']:setting(name,'net.ipv6.conf.all.forwarding' if ipv6 else 'net.ipv4.ip_forward',1)
 routes=[('client','default','2001:db8:1::1' if ipv6 else '10.210.1.1'),('target','default','2001:db8:3::1' if ipv6 else '10.210.3.1'),
 ('r1','2001:db8:3::/64' if ipv6 else '10.210.3.0/30','2001:db8:2::2' if ipv6 else '10.210.2.2'),
 ('r2','2001:db8:1::/64' if ipv6 else '10.210.1.0/30','2001:db8:2::1' if ipv6 else '10.210.2.1')]
 for name,destination,gateway in routes:ip(name,family,'route','add',destination,'via',gateway)
 if ipv6:
 deadline=time.monotonic()+4
 while any('tentative' in ip(name,'-6','address','show').stdout for name in ['client','r1','r2','target']):
 assert time.monotonic()<deadline,'IPv6 link-local DAD did not finish';time.sleep(.02)
def nft(name,script):return ns(name,'nft','-f','-',input=script)
def counters(name):
 result={}
 for item in json.loads(ns(name,'nft','-j','list','ruleset').stdout)['nftables']:
 rule=item.get('rule',{})
 if 'comment' in rule:
 for expression in rule['expr']:
 if 'counter' in expression:result[rule['comment']]=expression['counter']['packets']
 return result
def capture(stack,root,name,interface,expression,label):
 path=root/(label+'.pcap')
 process=subprocess.Popen(['ip','netns','exec',name,'tcpdump','--immediate-mode','-Z','root','-U','-n','-i',interface,'-w',str(path),expression],stdout=subprocess.DEVNULL,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process);deadline=time.monotonic()+3
 while time.monotonic()<deadline:
 assert process.poll() is None,'capture exited'
 if select.select([process.stderr],[],[],.1)[0] and 'listening on' in process.stderr.readline():return process,path
 raise AssertionError('capture did not become ready')
def captured(process,path):
 process.send_signal(signal.SIGINT);_,diagnostic=process.communicate(timeout=3);assert process.returncode==0,diagnostic
 return run('tcpdump','-nn','-vv','-r',str(path)).stdout


def server(stack):
 code=r'''
import socketserver,hashlib
class Handler(socketserver.StreamRequestHandler):
 def handle(self):
 self.request.settimeout(3)
 header=self.rfile.readline()
 if not header:return
 length=int(header);data=self.rfile.read(length)
 if len(data)!=length:return
 self.wfile.write(hashlib.sha256(data).hexdigest().encode()+b'\n');self.wfile.flush()
class Server(socketserver.ThreadingTCPServer):allow_reuse_address=True;daemon_threads=True
service=Server(('10.210.3.2',18080),Handler);print('ready',flush=True);service.serve_forever()
'''
 process=spawn(stack,['ip','netns','exec','target','python3','-u','-c',code]);assert line(process).strip()=='ready'
def transfer(size):
 code=r'''
import socket,json,hashlib,sys,struct
size=int(sys.argv[1]);stream=socket.socket();stream.settimeout(1.5);connected=False
try:
 stream.connect(('10.210.3.2',18080));connected=True
 stream.sendall(str(size).encode()+b'\n'+b'x'*size)
 with stream.makefile('rb') as incoming:reply=incoming.readline().decode().strip()
 assert reply==hashlib.sha256(b'x'*size).hexdigest()
 print(json.dumps({'ok':True,'connected':True,'bytes':size,'sha256':reply,'snd_mss':stream.getsockopt(socket.IPPROTO_TCP,socket.TCP_MAXSEG)}))
except OSError as error:
 stream.setsockopt(socket.SOL_SOCKET,socket.SO_LINGER,struct.pack('ii',1,0))
 print(json.dumps({'ok':False,'connected':connected,'type':type(error).__name__,'errno':error.errno}))
finally:stream.close()
'''
 return json.loads(ns('client','python3','-c',code,str(size)).stdout)
def hide_fragmentation_feedback():
 nft('r1','''table ip hidden_mtu {
 chain output { type filter hook output priority 0; policy accept;
 icmp type destination-unreachable icmp code frag-needed counter drop comment "fragmentation_feedback_dropped"
 }
}
''')
results={}
for hidden in [False,True]:
 with lab() as (root,stack,setting):
 topology(setting);setting('client','net.ipv4.tcp_mtu_probing',0);server(stack)
 if hidden:hide_fragmentation_feedback()
 small=transfer(128);assert small['ok']
 before=ip('client','route','get','10.210.3.2').stdout
 tap,path=capture(stack,root,'client','c0','icmp or tcp port 18080','pmtu')
 large=transfer(65536);trace=captured(tap,path);after=ip('client','route','get','10.210.3.2').stdout
 if hidden:
 assert not large['ok'] and large['connected'] and large['type']=='TimeoutError',large
 count=counters('r1');assert count['fragmentation_feedback_dropped']>0
 else:
 assert large['ok'] and 'mtu 1280' in after,(large,after)
 assert 'unreachable - need to frag (mtu 1280)' in trace,trace;count={}
 results[str(hidden)]={'small_transfer':small,'large_transfer':large,'route_before':before,'route_after':after,
 'icmp_feedback_filtered':hidden,'counter':count,'capture':trace}
print(json.dumps(results))
"""
name='xbcatm-mtupath-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN','--cap-add','SYS_ADMIN','--memory','256m','--pids-limit','128',name,'python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

Both endpoint links have MTU 1500, while the router-to-router link has MTU 1280. This placement matters: neither endpoint simply advertises a smaller local-interface MSS during setup. The client explicitly disables TCP’s separate MTU probing feature so the comparison isolates classic ICMP-based discovery. Each trial creates fresh namespaces, avoiding a learned destination estimate leaking from the healthy case into the filtered case.

With feedback permitted, a 128-byte transfer succeeds first. A new connection then sends 65536 bytes and verifies the server’s SHA-256 response. The capture contains an ICMP message reporting that fragmentation is needed with MTU 1280. The client’s route lookup subsequently shows a cached MTU of 1280, and the socket reports an effective sending MSS of 1228 in this timestamp-enabled exchange.

The second topology suppresses only the first router’s outgoing fragmentation-needed messages. Its small transfer still succeeds, and the larger transfer completes TCP setup before timing out. The rule counter records actual suppressed feedback, while the client’s route lookup has not learned the smaller MTU. These observations connect size-dependent failure to the deliberately missing discovery signal instead of blaming a stopped listener.

Failed test sockets are explicitly aborted so their queued retransmissions do not contaminate subsequent observations. The socket’s 1.5-second timeout bounds individual blocking operations, not the whole transaction or the operating system’s retry lifetime; outer subprocess deadlines bound the fixture. Successful cases validate exact payload content, while failed cases preserve both the local connection result and timeout type. That distinction keeps a successful handshake from being reported as successful data delivery.

Interpret captures at the correct processing point

Local captures may show large offload representations or apparent partial checksums. Such records are not automatically the final segments placed on a physical link, so a large captured length does not prove that an oversized wire packet crossed the bottleneck. Correlate route state, ICMP feedback, effective MSS, and application results rather than interpreting one capture field without its processing context.

Use several meaningful payload sizes when diagnosing a path, and account for IP, transport, option, and tunnel overhead. A ping payload size is not the full IP packet size, and an application write is not one TCP segment. Preserve the original failing traffic direction because success with a small response in the reverse direction may not exercise the same constraint.

Restore required feedback or correct the actual path configuration, then repeat a representative transfer from a fresh state. A transport-specific workaround may relieve one application without repairing discovery for other protocols. This laboratory demonstrates classic IPv4 discovery and its deliberate failure; it does not certify every alternate probing algorithm or establish a universal timeout for an arbitrary internet path.

Sources

RFC 1191 Path MTU Discovery, IPv4 DF, fragmentation-needed feedback and path estimates, checked 2026-10-15.
Linux ip(7), path MTU discovery and cached destination information, checked 2026-10-15.
Linux IP sysctl documentation, TCP MTU probing as a separate configurable mechanism, checked 2026-10-15.
Linux segmentation offloads, the distinction between local packet representations and transmitted segments, checked 2026-10-15.
Linux checksum offloads, partial checksum interpretation in local captures, checked 2026-10-15.
Python socket timeout reference, blocking-operation timeout scope, checked 2026-10-19.