What is Path MTU Discovery (PMTUD)?
Learn how Path MTU Discovery finds the smallest MTU along a route using ICMP, and why blocked ICMP causes black holes — interview Q&A.
Expected Interview Answer
Path MTU Discovery (PMTUD) is the process a sending host uses to find the smallest MTU along the entire route to a destination, by sending packets with the Don’t Fragment (DF) bit set and shrinking the packet size whenever a router replies with an ICMP 'fragmentation needed' error, so the host can send packets that traverse the whole path without being fragmented.
Every link on a path can have a different MTU (Ethernet is typically 1500 bytes, but tunnels, VPNs, and PPPoE links often have smaller MTUs due to added headers). If a router receives a packet larger than the next hop’s MTU and the packet has the DF bit set, it cannot fragment it, so it drops the packet and sends back an ICMP Type 3 Code 4 'Fragmentation Needed' message containing the MTU of the link that could not forward it. The sending host uses that value to shrink its packet size and retransmit, repeating the process until packets flow through unfragmented for the entire path — the smallest MTU on any hop becomes the effective 'path MTU.' The well-known failure mode is 'PMTUD black holes': if a firewall along the path blocks ICMP entirely, the sender never receives the fragmentation-needed message and keeps sending oversized packets that silently vanish, which shows up as connections that work for small transfers (like a TCP handshake) but hang or stall once larger data starts flowing.
- Lets a host find the largest packet size that traverses the entire path unfragmented
- Avoids the performance cost of in-network fragmentation and reassembly
- Relies on ICMP "fragmentation needed" messages from routers along the path
- Vulnerable to black holes when ICMP is filtered somewhere on the route
AI Mentor Explanation
Path MTU Discovery is like a groundskeeper sending an oversized equipment trolley marked 'do not disassemble' down the tunnel to the pitch, and every gate along the way that is too narrow sends the trolley straight back with a note stating exactly how wide it actually is. The groundskeeper resizes the trolley to the narrowest gate reported and tries again until it clears every gate on the route. If one gate along the way refuses to send any note back at all, the trolley just keeps vanishing with no explanation, and deliveries mysteriously fail. That silent failure is exactly what happens when a firewall blocks the ICMP messages PMTUD depends on.
Step-by-Step Explanation
Step 1
Send with DF set
The host sends a packet at its interface MTU (e.g., 1500 bytes) with the IP Don’t Fragment bit set.
Step 2
Router hits a smaller MTU
A router along the path that must forward onto a link with a smaller MTU cannot fragment the DF-marked packet, so it drops it.
Step 3
ICMP feedback
That router sends back an ICMP Type 3 Code 4 "Fragmentation Needed" message containing the next-hop MTU it could not use.
Step 4
Shrink and retry
The sending host lowers its packet size to that reported MTU and retransmits, repeating until packets traverse the whole path unfragmented.
What Interviewer Expects
- Explains the DF bit and ICMP fragmentation-needed feedback loop
- Understands the discovered path MTU is the minimum MTU across all hops
- Can describe the black-hole failure mode caused by ICMP filtering
- Connects PMTUD relevance to tunnels/VPNs that reduce effective MTU
Common Mistakes
- Confusing PMTUD with normal IP fragmentation (PMTUD avoids fragmentation, it does not perform it)
- Not knowing why blocking all ICMP breaks PMTUD instead of just being “more secure”
- Thinking PMTUD is IPv6-only (it works for IPv4 too, though IPv6 routers never fragment at all, making PMTUD more critical there)
- Forgetting that symptoms show up only on larger transfers, not the initial handshake
Best Answer (HR Friendly)
“Path MTU Discovery is how a computer figures out the biggest packet size it can send across the internet to a destination without any router along the way having to chop it up. It sends a test packet marked 'do not split me,' and if a router along the route can’t forward it at that size, the router sends back a message saying how big it can handle — the sender then shrinks the packet and tries again until it fits the whole path.”
Code Example
# Send a non-fragmenting ping, sweeping payload size to find the path MTU
ping -M do -s 1472 8.8.8.8 # 1472 + 28 = 1500, standard Ethernet MTU
# If this fails: Frag needed and DF set
# Trace the MTU along each hop
tracepath 8.8.8.8
# 1: gateway (192.168.1.1) 0.4ms
# 2: isp-router (203.0.113.1) pmtu 1492
# 3: ...Follow-up Questions
- What is a PMTUD black hole and how do you troubleshoot it?
- Why does PMTUD matter more for IPv6, where routers never fragment?
- How does MSS clamping relate to Path MTU Discovery?
- How do VPN and PPPoE overhead typically reduce the effective MTU?
MCQ Practice
1. What ICMP message does PMTUD rely on to discover a smaller MTU?
A router that cannot forward a DF-marked oversized packet returns ICMP Type 3 Code 4 with the MTU it can actually support.
2. What causes a "PMTUD black hole"?
If ICMP is filtered anywhere on the path, the sender never learns to shrink its packets, and they are silently dropped.
3. The discovered “path MTU” between two hosts equals what?
Path MTU is bounded by the most restrictive (smallest) MTU link anywhere along the route.
Flash Cards
What is Path MTU Discovery? — A process using DF-marked packets and ICMP feedback to find the smallest MTU along a route, so packets are sent unfragmented.
What ICMP message drives PMTUD? — Type 3 Code 4, "Fragmentation Needed," sent by a router that cannot forward an oversized DF packet.
What is a PMTUD black hole? — When a firewall blocks the ICMP reply, so the sender never shrinks its packets and they are silently dropped.
What is the discovered path MTU equal to? — The smallest MTU found on any single link along the entire path.