Confusion about MTU

Question

I am studying about IP fragmentation and MTU. What I know is MTU is the property of Physical medium, as in the amount of data it can process without having to fragment the data. The default MTU on machine is set to 1500. From reading on the web I understand that 28 bytes is reserved for ICMP so my actual MTU is 1472.

If I set DF bit to one and packet size to 1472, I get ping responses and I see traffic in Wireshark for the same

ping 8.8.8.8 -f -l 1472

Pinging 8.8.8.8 with 1472 bytes of data:
Reply from 8.8.8.8: bytes=68 (sent 1472) time=60ms TTL=113
Reply from 8.8.8.8: bytes=68 (sent 1472) time=67ms TTL=113
Reply from 8.8.8.8: bytes=68 (sent 1472) time=77ms TTL=113
Reply from 8.8.8.8: bytes=68 (sent 1472) time=44ms TTL=113

But if I ping with packet size 1473, I get below:

C:\Users\admin>ping 8.8.8.8 -f -l 1473

Pinging 8.8.8.8 with 1473 bytes of data:
Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.

I had a Wireshark running when I initiated this Ping but I never see this in Wireshark. How come this is not seen on Wireshark? I mean should I not see some ICMP response? I believe if the TCP/IP Stack on my machine sees that DF bit is set and MTU is exceeding then it will itself drop the packet? Can someone confirm?

Further, if I remove the DF flag then I do see ICMP pings in Wireshark but the ping fails:

C:\Users\admin>ping 8.8.8.8 -l 1473

Pinging 8.8.8.8 with 1473 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Why would this fail? I tried changing the MTU on my machine manually from 1500 to 1501

  MTU  MediaSenseState   Bytes In  Bytes Out  Interface
------  ---------------  ---------  ---------  -------------
4294967295                1   54991843          0  Loopback Pseudo-Interface 1
  1500                5          0          0  Wi-Fi
  1500                5          0          0  Ethernet
  1500                5          0          0  Local Area Connection* 14
  1500                5          0          0  Local Area Connection* 15
  **1501                1  114787330   26005606  Ethernet 2**
  1500                1          0     755762  VirtualBox Host-Only Network

Even after increasing the MTU I get Request time out. Can someone explain this? Is this because my machines capacity is still 1500 bytes and changing it to 1500 will not have any effect?

Answer 1

From reading on the web I understand that 28 bytes is reserved for ICMP so my actual MTU is 1472.

No, the MTU is size of the payload of the data-link protocol. For ethernet, that is 1500. You are confusing the network layers. Network-layer, e.g. IP, packets are the payload of the data-link protocol, so the MTU is how large the network packet can be, but the network packet is not required to be as large as the MTU.

An IPv4 packet, including the IPv4 packet header, can be as large as 65,535 bytes, which is much larger than any MTU you will find. IPv6 does it differently, and its payload can be as large as 65,535, excluding the IPv6 packet header (there is also an Option header that allows an IPv6 payload to be as large as 4,294,967,295).

ICMP, even though it is an integral part of IP (both IPv4 and IPv6), is treated as a transport-layer protocol, so it is the payload of IP. Yes, there is an ICMP header, the same way there is a UDP or TCP header.

You seem to want to count the maximum payload size of the transport layer as the MTU, but that is incorrect, it is the maximum size of a data-link protocol payload. TCP has something called MSS that gives you the maximum TCP segment size, but other than that, you need to calculate the maximum data size from the encapsulating protocols.

Think about the WWW. The data for that is HTML, but that gets encapsulated by HTTP or HTTPS, then encapsulated by TCP, then by one of the IP versions, then by the data-link protocol. The MTU only reflects the maximum size of the data-link payload, but you need to figure out what other protocols are used to determine the maximum data size you can send in each packet, and that will vary by the protocols used in the stack.

---

Setting the DF bit means that intermediate devices, e.g. routers, in the path are not allowed to fragment an IPv4 packet in transit. IPv6 does not have that flag because fragmentation simply is not allowed in the path for IPv6. We now have PMTUD, which is required for IPv6 because IPv6 must have a minimum MTU of 1280 in the path for it to work. Many OSes and application now work with PMTUD for IPv4 also, and that is the preferred way to do it.

Most smart businesses now drop packet fragments to prevent fragmentation attacks, and fragmentation is resource intensive, which is why it was dropped from IP with IPv6.

I tried changing the MTU on my machine manually from 1500 to 1501

Do not mess with that unless you have non-standard jumbo frame support, and you really know what you are doing. The ethernet MTU is 1500. Some vendors allow jumbo frame support, but it must be enabled all through the frame path, otherwise the frame will simply be dropped in the path.

Answer 2

The Maximum Transmission Unit is the biggest size of IP datagram which may be transferred using a specific data link connection The maximum transmission unit was sw value is a design parameter of a LAN and is a mutually agreed with value (i.e. both ends at source and destination of a link agree to use the same specific value) for most isp or point to point links.

The size of maximum transmission unit may vary greatly between different connections(e.g. typically from 128 B up to 10 kB).The prevalent Path maximum transmission unit on the Internet is now 1500 bytes, the Ethernet maximum transmission unitsl. There are some initiatives to support larger MTUs in networks .in particular on research networks. But their usability is hampered by last-mile deployment of Ethernet with an MTU of 1500 and lack of robustness of Path MTU Discovery. This lead to a more robust method being defined in [RFC4821].

The transport layer (TCP or UDP) is not aware of the particular path taken by IP packet as it travels through a network. It therefore does not know what size of IP packet to generate. Too small a packet may be inefficient (i.e. there may be little data compared to lots of header), a larger packet is therefore more efficient. Too large an IP packet may exceed the maximum transmission unit of the links over which the packet may be sent, causing fragmentation.