{{tag>howto mtu pathmtu vpn networking videoconferencing portknocking packetsize tracepath traceroute iputilstracepath}}


====== Finding the correct path MTU ======

Finding the correct value for path [[https://en.wikipedia.org/wiki/Maximum_transmission_unit|MTU]] might come in handy if you experience problems with VPN connections, video conferences or port knocking. I stumbled over this around 2014 when I've been a business customer at Kabel Deutschland/Vodafone.

I assume you are using Linux. On [[https://en.wikipedia.org/wiki/Debian|debian]] and it's derivates just install //tracepath// via apt.

<sxh bash; gutter: false>
apt -y install iputils-tracepath
tracepath www.google.de
</sxh>

  1?: [LOCALHOST]                      pmtu 1500
  1:  pfSense.xxxxxx.xx                                     1.515ms 
  1:  pfSense.xxxxxx.xx                                     0.803ms 
  2:  fritz.box                                             1.284ms 
  3:  192.0.0.2                                             1.505ms pmtu 1460
  3:  ip53a9b731.static.kabel-deutschland.de               11.703ms 
  4:  ip5886edbb.static.kabel-deutschland.de               19.727ms 
  5:  145.254.3.60                                         16.172ms 
  6:  145.254.2.175                                        15.456ms asymm  7 
  7:  145.254.2.175                                        16.805ms 
  8:  no reply
     Too many hops: pmtu 1460
     Resume: pmtu 1460 

As you can see, the MTU drops to 1460 at hop 3. That's because Kabel Deutschland/Vodafone is still running [[https://en.wikipedia.org/wiki/IPv6_transition_mechanism#Dual-Stack_Lite_(DS-Lite)|DS-Lite]], an IPv6 transition mechanism, in 2021. That causes your IPv4 Packets to get wrapped into an IPv6 packet which causes [[https://en.wikipedia.org/wiki/IP_fragmentation|fragmentation]].

There is another command which can be used to find the path MTU. It's //traceroute//:

<sxh bash>
traceroute --mtu www.google.de
</sxh>

  traceroute to www.google.de (172.217.22.195), 30 hops max, 65000 byte packets
   1  pfSense.xxxxxx.xx (10.10.50.1)  0.954 ms F=1500  0.646 ms  0.707 ms
   2  fritz.box (192.168.2.1)  1.123 ms  1.054 ms  1.086 ms
   3  83-169-183-49-isp.superkabel.de (83.169.183.49)  12.923 ms F=1460  12.524 ms  11.722 ms
   4  ip5886edbb.static.kabel-deutschland.de (88.134.237.187)  14.579 ms  14.417 ms  16.797 ms
   5  145.254.3.60 (145.254.3.60)  13.371 ms  13.320 ms  13.748 ms
   6  145.254.2.175 (145.254.2.175)  17.586 ms  14.530 ms  17.386 ms
   7  145.254.2.175 (145.254.2.175)  27.975 ms  20.617 ms  13.480 ms
   8  72.14.195.160 (72.14.195.160)  24.337 ms  18.965 ms  21.535 ms
   9  108.170.247.113 (108.170.247.113)  21.433 ms  15.377 ms 108.170.247.97 (108.170.247.97)  16.248 ms
  10  108.170.234.217 (108.170.234.217)  17.219 ms 209.85.142.129 (209.85.142.129)  16.759 ms  17.982 ms
  11  muc11s01-in-f3.1e100.net (172.217.22.195)  15.696 ms  15.307 ms  17.975 ms
 
At hop 3 you will see "**F=1460**" which indicates the mtu dropping to 1460.

~~DISCUSSION~~