IP fragmentation is an often-underestimated but critical phenomenon for network stability and performance, especially over Wide Area Network (WAN) links between remote sites. When an IP packet exceeds the Maximum Transmission Unit (MTU) of a network interface, it is fragmented into smaller packets. While necessary, this process introduces overhead and can lead to performance issues, application timeouts, and disconnections of sensitive sessions like VPNs or VoIP calls. Identifying fragmentation requires a methodical approach, combining basic diagnostic tools with in-depth network traffic analysis. I have tackled these scenarios in enterprise environments with hundreds of VMs and thousands of endpoints, where even a single bottleneck can have a significant cascading impact.
Tested on: Ubuntu 24.04 LTS · Cisco IOS XE 17.x · FortiGate OS 7.x · September 2026
Prerequisites / Test Environment
To effectively diagnose IP fragmentation, you will need access to:
- A Linux or Windows host with standard network tools (ping, traceroute).
- A packet capture application like Wireshark installed on a host that can monitor traffic on the WAN link or on a router that supports packet capture.
- Administrative-level access to network devices (routers, firewalls) managing the inter-site link, to verify and modify MTU configurations.
- The ability to generate test traffic between the two sites to replicate the problem in a controlled environment.
1. Understanding MTU and Path MTU Discovery (PMTUD)
MTU is the maximum packet size, including IP headers, that an interface can transmit without fragmentation. Typically, for Ethernet, the MTU is 1500 bytes. However, on WAN links (e.g., PPPoE, MPLS, VPN tunnels), the effective MTU can be lower due to additional overhead introduced by tunneling protocol headers. Path MTU Discovery (PMTUD) is a mechanism that allows a host to determine the minimum MTU along a network path. It works by sending packets with the ‘Don’t Fragment’ (DF) bit set. If a router on the path receives a packet that is too large, it should discard it and send an ICMP ‘Fragmentation Needed’ (Type 3, Code 4) message back to the source, indicating the maximum MTU supported by its link. Read also: ICMP: Fundamental Network Diagnostics
2. Identify Path MTU with the ping Command
The first practical step is to use the ping command with the ‘Don’t Fragment’ option (-M do on Linux/macOS, -f on Windows) to determine the Path MTU. Start with a standard packet size (1472 bytes for a 1500-byte IP packet, considering 20 bytes for the IP header and 8 bytes for the ICMP header) and gradually reduce the size until packets pass without fragmentation.
Run the command from a host at one site to a host at the other site:
ping -s 1472 -M do your_remote_hostIf you receive a message similar to ping: local error: message too long, mtu=1400 or Packet needs to be fragmented but DF set, it means the packet size is too large for a router on the path. Continue to reduce the size (-s) until the ping is successful. The first working -s value, plus 28 bytes (IP + ICMP header), will give you the Path MTU.
For example:
ping -s 1472 -M do 192.168.10.1
PING 192.168.10.1 (192.168.10.1) 1472(1500) bytes of data.
From 192.168.1.1 icmp_seq=1 Frag needed and DF set (mtu = 1400)
From 192.168.1.1 icmp_seq=2 Frag needed and DF set (mtu = 1400)
ping -s 1372 -M do 192.168.10.1
PING 192.168.10.1 (192.168.10.1) 1372(1400) bytes of data.
64 bytes from 192.168.10.1: icmp_seq=1 ttl=60 time=10.2 msIn this case, the Path MTU is 1400 bytes.
3. Traffic Analysis with Wireshark
ping is useful for determining MTU, but Wireshark provides a detailed view of what happens at the packet level. Capture traffic on an interface near the point where you suspect fragmentation is occurring (e.g., the WAN interface of the router or firewall). Read also: Nmap: Complete Guide to Network Scanning and Security Audits (2026)
Useful Wireshark filters:
ip.flags.df == 0: Shows packets that have been fragmented (the DF bit was not set or was ignored).ip.frag_offset != 0: Shows fragments subsequent to the first. The first fragment hasip.frag_offset == 0and usually contains higher-layer headers (TCP/UDP).icmp.type == 3 && icmp.code == 4: Shows ICMP ‘Fragmentation Needed’ messages (Type 3, Code 4), which indicate that a router has discarded a packet with DF set and signaled its link’s MTU.
Packet analysis will allow you to:
- Verify if packets are actually being fragmented.
- Identify which applications or protocols generate traffic that exceeds the MTU.
- See if ICMP ‘Fragmentation Needed’ messages are generated and if they reach the source. Sometimes, these messages can be blocked by firewalls, preventing PMTUD from working correctly.
An example of Wireshark output filtered for ip.flags.df == 0 might show:
Frame 123: 1514 bytes on wire (12112 bits), 1514 bytes captured (12112 bits)
Ethernet II, Src: aa:bb:cc:dd:ee:ff, Dst: ff:ee:dd:cc:bb:aa
Internet Protocol Version 4, Src: 10.0.0.1, Dst: 10.0.0.2
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
Total Length: 1400
Identification: 0x1234 (4660)
Flags: 0x2000 (Don't Fragment)
Fragment offset: 0
Time to live: 64
Protocol: TCP (6)
Header checksum: 0xabcd [correct]
[Header checksum status: Good]
Source Address: 10.0.0.1
Destination Address: 10.0.0.2
Transmission Control Protocol, Src Port: 12345, Dst Port: 8080, Seq: 1, Ack: 1, Len: 1360Common Errors and Troubleshooting
- Firewalls blocking ICMP: If ICMP ‘Fragmentation Needed’ messages are blocked by firewalls, PMTUD fails. Hosts will continue to send packets with DF set, which will be discarded, causing a ‘black hole’ for large packets. Ensure firewalls allow ICMP Type 3, Code 4.
- Inconsistent MTU: If MTU is not configured consistently across all devices along the path, problems will occur. All devices (routers, L3 switches, firewalls, VPN interfaces) must have a compatible MTU.
- MSS Clamping Configuration: For TCP connections traversing VPN tunnels (IPsec, OpenVPN, WireGuard), it is good practice to configure Maximum Segment Size (MSS) Clamping. This reduces the maximum TCP segment size announced during the handshake, preventing the sending host from sending TCP segments larger than the tunnel’s MTU, thereby preventing TCP-level fragmentation. Consult Cisco’s official documentation for MSS Clamping
FAQ — Frequently Asked Questions
Do I need to change the MTU on all network devices?
No, not necessarily on all. You need to identify the minimum Path MTU and configure the MTU of WAN interfaces and VPN tunnels to be equal to or less than that value. Internal LAN devices can maintain the standard 1500 MTU, unless they are directly involved in routing fragmented packets.
Does IP fragmentation only affect VPNs?
No, IP fragmentation can affect any traffic traversing a link with an MTU lower than that of the sender. VPNs are particularly sensitive because they add significant overhead, reducing the effective MTU available for the original payload.
How can I prevent fragmentation in the future?
Prevention involves careful network design, especially for WAN links and VPN tunnels. Know your Path MTU and configure interface MTUs accordingly. Implement MSS Clamping for TCP traffic traversing VPN tunnels, and ensure that ICMP ‘Fragmentation Needed’ messages are not blocked by firewalls.
Is it always better to avoid fragmentation?
Yes, in general, it is always preferable to avoid IP fragmentation. Fragmentation increases router CPU load, introduces delays due to fragment reassembly, and increases the likelihood of packet loss (if even a single fragment is lost, the entire original packet must be retransmitted).
Conclusions with Operational Takeaways
IP fragmentation is a subtle issue that can significantly degrade network performance without an apparent cause. The methodical approach combining the use of ping with the ‘Don’t Fragment’ option and detailed traffic analysis with Wireshark is fundamental for diagnosis. Once the Path MTU is identified, optimizing MTU configurations on routers and firewalls, along with implementing MSS Clamping for VPN tunnels, will restore stability and speed to inter-site links. Remember that network traffic visibility is key to resolving complex problems like this.
Sources
Updated: September 2026
