Maximum Transmission Unit (MTU) determines the largest packet size that can traverse a network path without fragmentation — an often-overlooked setting that can cause subtle, confusing connectivity issues when misconfigured.
What MTU Actually Controls
The maximum size (in bytes) of a single network packet that can be sent without fragmentation — the standard Ethernet MTU is 1500 bytes; VPN tunnels, certain network configurations, and some cloud networking setups sometimes require a smaller effective MTU.
Why MTU Mismatches Cause Problems
If a packet exceeds the MTU of some link along its path and fragmentation is blocked or mishandled, the packet is silently dropped — this often manifests as strange, inconsistent connectivity issues: small requests work fine, but larger transfers fail or hang.
Checking Your Current MTU
ip addr show eth0 | grep mtuCommon Symptom Pattern: SSH Works, But Some Operations Hang
A classic MTU-mismatch symptom — SSH's initial connection (small packets) works fine, but operations transferring larger amounts of data (a large file, a big command's output) hang or fail; this pattern strongly suggests checking MTU as a likely cause.
Testing for MTU Issues
ping -M do -s 1472 yourdomain.com-M do prevents fragmentation; -s 1472 sends a payload sized to result in a 1500-byte packet total (1472 + 28 bytes of ICMP/IP header) — if this fails but smaller sizes succeed, you've likely found an MTU issue along the path.
Finding the Actual Working MTU
ping -M do -s 1400 yourdomain.com
ping -M do -s 1300 yourdomain.comReduce the size incrementally until pings succeed, helping identify the actual maximum working size for the specific network path.
Adjusting MTU on a VPN Interface (Common Scenario)
VPN tunnels add their own header overhead, often requiring the tunnel's effective MTU to be smaller than the standard 1500 — WireGuard and OpenVPN configurations typically let you explicitly set an appropriate MTU:
# WireGuard config
MTU = 1420Setting MTU on a Standard Network Interface
sudo ip link set eth0 mtu 1400Only adjust this if you've genuinely diagnosed an MTU-related issue — don't change it speculatively without evidence, since an incorrect change can itself cause connectivity problems.
MTU and Docker/Container Networking
Docker's default bridge network sometimes needs explicit MTU configuration in environments with non-standard host MTU settings, particularly noticeable in some VPN or cloud networking configurations — a docker daemon configuration setting if this specific issue arises.
When to Suspect an MTU Issue
- Small requests/connections work, larger data transfers hang or fail inconsistently
- Issue is specific to certain network paths (e.g. through a VPN, but not on a direct connection)
- Symptoms don't match typical firewall/routing issues, which usually fail consistently rather than only for larger payloads
Common Errors
VPN connects but some traffic through it hangs — a classic MTU issue specific to VPN tunnel overhead; explicitly set an appropriate lower MTU in the VPN configuration.
Continue Reading
- How to Set Up a VPN Server with WireGuard
- How to Diagnose and Fix High Network Latency
- How to Configure Multiple Network Interfaces on a VPS
Browse more articles in Networking & DNS.
