top of page
Search

MTU Black Hole: ping -M do -s 1472 When One Path Dies and Small Packets Live

  • 3 days ago
  • 2 min read
Linux / packet path network security troubleshooting lab
Linux / packet path · Techclick CLI troubleshooting lab
SSH works. HTTPS hangs after ClientHello. Any VPN or GRE in the path. Small ping works.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

  • Name the first CLI command to run on Linux / packet path for this ticket

  • Separate the layer that is actually broken from the layer people blame

  • Apply one scoped fix instead of a global disable

  • Prove the ticket closed with a session, log, or counter

Quick answer

A device is dropping DF large packets and not sending ICMP need-to-frag. Clamp MSS or fix MTU. This is the classic black hole.

Why this ticket shows up

TCP tries 1500. Encapsulated path is 1400. Silent drop of DF packets kills large segments only.

Symptoms operators actually see

  • Small packets OK, large fail

  • VPN/GRE/IPsec in path

  • HTTPS hangs, SSH interactive OK

  • No ICMP unreachable

CLI first — copy this block

Run these on the Linux / packet path device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

ping -M do -s 1472 203.0.113.10
ping -M do -s 1372 203.0.113.10
tracepath 203.0.113.10
ip route get 203.0.113.10
iptables -t mangle -S | grep TCPMSS

How to read that output

1472 DF fail and 1372 DF success means PMTU is lower. If ICMP is filtered, hosts never learn and HTTPS dies.

Triage order

  1. Binary-search ping size with DF

  2. Set tunnel MTU or tcp mss-adjust 1360

  3. Allow ICMP need-to-frag if policy allows

  4. Retest HTTPS

  5. Document the tunnel overhead

Classic traps

What you see

Real cause

Fix

Disable the firewall

It is MTU

Clamp MSS

Reinstall the browser

SSH already proved TCP works

Size is the issue

Set MTU 1500 on the tunnel

Overhead still exists

Go lower

Proof the ticket is closed

  • 1472 DF works or MSS is clamped

  • HTTPS completes

  • Tunnel MTU documented

Say this in an interview

Large-only failure on a tunnel is PMTU. I prove it with DF pings before I touch certificates.

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/

Comments

bottom of page