MTU

MTU (maximum transmission unit) is the largest packet size, in bytes, that a network interface or link can carry in a single frame without fragmentation. In networking and transport protocols, the MTU defines the ceiling for everything above the link layer: the IP header, the transport header and the payload together must fit inside it, which is why TCP derives its segment size from the MTU and why UDP applications must keep datagrams below it.

The value most engineers meet first is the Ethernet MTU of 1500 bytes, but real paths mix links with different limits. The smallest MTU along a route, the path MTU, decides what actually gets through, and mismatches between configured and real values cause some of the most confusing failures in production networks: connections that open but then stall.

How the MTU limits packet size on a link

The MTU is a property of the link layer that the network layer must respect. An Ethernet frame carries up to 1500 bytes of payload, and that payload is the complete IP packet. The Ethernet header (14 bytes), the optional 802.1Q VLAN tag (4 bytes) and the frame check sequence (4 bytes) are not counted in the MTU, which is a frequent source of off-by-a-few errors in documentation and vendor interfaces.

Inside the MTU, every protocol layer consumes space. A 20-byte IPv4 header (without options) or a 40-byte IPv6 header comes first, followed by the transport header: 20 bytes for TCP without options and 8 bytes for UDP. What remains is the payload available to the application. The table shows how a standard 1500-byte MTU is divided in common cases.

When a packet is larger than the next link’s MTU, the router has two options. In IPv4, it may fragment the packet into pieces that each fit, unless the sender set the DF (do-not-fragment) bit; in that case it drops the packet and returns an ICMP “fragmentation needed” message. In IPv6, routers never fragment: only the sender can fragment, and an oversized packet always triggers an ICMPv6 “Packet Too Big” message.

Typical MTU values and where they come from

MTU values are set by the link technology and by encapsulation. Every tunnel or overlay adds its own headers inside the outer packet, so the inner MTU shrinks by the overhead of each layer. Knowing the common values makes it easy to recognize the cause of a mismatch from the number alone.

The IPv4 minimum is 68 bytes in theory, but every host must also accept reassembled datagrams of at least 576 bytes. In practice, the 1280-byte IPv6 minimum is the safest lower bound for protocols that cannot discover the path, which is why several UDP-based protocols, including QUIC, treat 1200 bytes of payload as a conservative default.

MTU compared with MSS, path MTU and fragmentation

The MTU is often confused with neighboring transport concepts. The key distinction is which layer each value describes and who sets it. The MTU belongs to an interface, the path MTU belongs to a route, and the MSS belongs to a single TCP connection.

The MSS is normally the MTU minus the IP and TCP headers, so a 1500-byte MTU gives an MSS of 1460 bytes over IPv4. Each side announces its MSS in the SYN segment of the TCP handshake, and the peer never sends larger segments. UDP has no such negotiation: an application that writes a datagram larger than the path MTU relies on IP fragmentation or loses the packet.

Path MTU Discovery (PMTUD) lets a sender learn the path MTU by setting the DF bit and reacting to ICMP errors. Because many firewalls drop ICMP indiscriminately, Packetization Layer PMTUD (PLPMTUD) probes with progressively larger packets and watches for acknowledgments instead, which works even when ICMP never arrives.

Choosing and configuring the MTU

The right MTU is the largest value that every device on the segment supports consistently. Hosts, switches and routers on one Layer 2 domain must agree; a single interface left at 1500 on a jumbo-frame network will silently drop large frames. The decision table summarizes common situations.

On routers that terminate tunnels or PPPoE, MSS clamping rewrites the MSS option in passing SYN segments so that TCP endpoints never generate segments too large for the tunnel. It is a pragmatic fix for TCP only; UDP and ICMP traffic still need a correct MTU. To test a path, send pings with the DF bit set and a fixed payload size, such as 1472 bytes for a 1500-byte IPv4 path, and reduce the size until replies return.

Common MTU problems and their symptoms

The classic MTU failure is the PMTUD black hole: small packets pass, large ones disappear, and no error reaches the sender because ICMP is filtered. The symptoms are distinctive once recognized, as the table shows.

A frequent misconception is that a larger MTU is always faster. Jumbo frames reduce per-packet overhead, but on the internet they offer no benefit because the path MTU falls back to 1500 or less. Another mistake is blocking all ICMP for security, which breaks path discovery; the specific “fragmentation needed” and “Packet Too Big” messages must be permitted.

A plain-language summary

The MTU is the size limit for one parcel on a network road. Data travels in packets, and each road can only carry packets up to a certain size. On most home and office networks that limit is 1500 bytes.

When a packet is too big for a road along the way, it must be cut into pieces or it gets thrown away. If the warning about the oversized packet is lost, the sender never learns the problem, and the connection appears frozen. The smallest limit along the whole route decides what gets through, so getting the MTU right keeps traffic flowing smoothly.

An example from practice

A small company connects two offices with a site-to-site IPsec tunnel over ordinary 1500-byte internet links. After the tunnel goes live, staff can open remote desktop sessions and load simple web pages, but large file transfers stall after a few seconds and email attachments time out.

The network administrator tests the path with DF-bit pings and finds that payloads above about 1390 bytes never return. The tunnel overhead reduces the usable MTU, and a firewall at one site drops the ICMP messages that would have told the hosts to send smaller packets. The administrator sets the tunnel interface MTU to 1400 bytes and enables MSS clamping to 1360 bytes on the tunnel routers.

The stalls disappear immediately: TCP connections now negotiate segments that fit inside the tunnel, and large transfers complete at the full speed of the link without fragmentation.