Troubleshooting PMTU issues

What is PMTU?

PMTU stands for Path Maximum Transmission Unit (often paired with PMTUD, or Path MTU Discovery).

In networking, it is the maximum packet size (measured in bytes) that can travel from a source host to a destination host without needing to be split up (fragmented) along the way.

To check the Path MTU (PMTU) in a Wireshark packet capture, you are essentially looking for the largest IP packet size that can pass through a network path without requiring fragmentation.

Because the standard Ethernet MTU is 1500 bytes, finding the PMTU involves looking for two specific clues in Wireshark:

The maximum size of successful packets.
ICMP “Fragmentation Needed” errors, which explicitly reveal the bottleneck.

Here is the step-by-step guide on how to check for PMTU using filters and packet details.

Method 1: Check the TCP MSS (Maximum Segment Size)

When a TCP connection starts, both sides advertise their Maximum Segment Size (MSS) in the initial SYN and SYN-ACK packets. The MSS is directly tied to the MTU ( $\text{MTU} = \text{MSS} + 40 \text{ bytes of TCP/IP headers}$ ).

Apply this filter to see the initial handshakes:
```
tcp.flags.syn == 1
```
Select a packet and look at the Packet Details pane.
Expand Transmission Control Protocol -> Options -> Maximum Segment Size.
If the MSS is 1460, the expected PMTU is 1500 ( $1460 + 40$ ). If the MSS is lower (e.g., 1420 due to a VPN or PPPoE tunnel), the PMTU is lower (1460).

Method 2: Look for ICMP “Fragmentation Needed”

Path MTU Discovery (PMTUD) works by sending packets with the Don’t Fragment (DF) flag set. If a router along the way has a smaller MTU than the packet size, it drops the packet and sends back an ICMP error message telling the sender what the maximum MTU allowed is.

To instantly find these packets in Wireshark, type this into the display filter:

icmp.type == 3 and icmp.code == 4

If you get results, it means a PMTU bottleneck was hit.

How to read the bottleneck MTU:

Click on the filtered ICMP packet.
In the Packet Details pane, expand Internet Control Message Protocol.
Look for the field labeled MTU of next hop (or Next-hop MTU).
The number listed there is the exact Path MTU limit of that restrictive router.

Method 3: Filter by Length to Find the Largest Successful Packet

If you want to see the actual size of the data packets traveling through the wire to verify if they are hitting the 1500-byte ceiling, you can filter by the IP total length field.

To find packets that are exactly standard Ethernet size (1500 bytes IP total length):
```
ip.len == 1500
```
To find packets that are larger than a specific size (e.g., if you suspect a smaller PMTU like 1420 due to a VPN):

    ip.len > 1420

⚠️ Note on “Wire Length” vs “IP Length”: In Wireshark’s top packet list pane, the Length column shows the Frame Length (which includes the 14-byte Ethernet header, making a standard packet 1514 bytes). However, when calculating PMTU, you must look at the IP Total Length field inside the IPv4 layer details, which excludes the Ethernet wrapper.

Summary Checklist for PMTU Troubleshooting

Is the DF flag set? Expand the Internet Protocol Version 4 section of your data packets and verify that Flags: 0x4000, Don't fragment is set. If DF is not set, routers will just fragment the packets instead of triggering PMTU discovery.
Are ICMP messages blocked? If you see a TCP connection suddenly “freeze” and stop transmitting right after a large data packet is sent, but you don’t see any ICMP Type 3 Code 4 packets, a firewall is blocking the ICMP replies. This is known as a PMTUD Black Hole.