The PMTUD black hole: when “Destination Unreachable” never arrives
There’s a familiar failure pattern in enterprise support queues: a connection that works perfectly for Slack and DNS lookups suddenly freezes on a large file upload, a video call, or an SSH session. The cause is usually not bandwidth or an outage, but a PMTUD black hole—a silent drop of oversized packets that occurs when a network path has a lower MTU than the sender assumes, and the network fails to signal that limitation back.
The problem is especially acute when traffic traverses networks you don’t control, where MTU restrictions are imposed by vendors or middleboxes beyond your administrative reach. With the Cloudflare One Client now implementing RFC 8899 Datagram Packetization Layer Path MTU Discovery (PMTUD), the client no longer waits passively for feedback that may never arrive—it actively discovers and adapts to the optimal packet size for the path.
Why modern security collides with legacy infrastructure
MTU defines the largest packet a device can send without fragmentation—typically 1500 bytes on standard Ethernet. As Cloudflare One has added enterprise-grade features such as FIPS 140-2 compliance, per-packet overhead from metadata and encryption has grown. That’s a deliberate trade-off for stronger protection, but it shrinks the effective payload space available inside that 1500-byte envelope.
Much of the Internet’s infrastructure was designed decades ago around a rigid expectation of 1500-byte packets. On networks with tighter constraints—LTE/5G, satellite links, or public safety networks like FirstNet—the usable space is often lower. When an encrypted packet exceeds the limit of an older router (say, 1300 bytes), that router should reply with an ICMP Destination Unreachable message requesting a smaller size.
But firewalls and middleboxes frequently drop those ICMP messages. Without that feedback, the sender keeps retransmitting packets that never arrive, leaving the application in a zombie state until the connection times out. This is the “silent drop” that turns routine network transitions into user-facing failures.
Active probing replaces passive assumption
Cloudflare’s PMTUD implementation eliminates the dependency on fragile ICMP feedback loops. Because the client uses the MASQUE protocol, built on Cloudflare’s open source QUIC library, it can probe the network path end-to-end in an active and encrypted manner.
Instead of waiting for an error that may never come, the client sends encrypted packets of varying sizes to the Cloudflare edge. These probes test MTUs from the upper bound of the supported range down to the midpoint, progressively narrowing to the exact limit the path permits. If the edge receives a probe, it acknowledges it; if a probe is lost, the client knows the capacity of that segment precisely.
The client then resizes its virtual interface MTU on the fly, periodically re-validating the path’s capacity beyond what was established at connection onset. Dynamic Path MTU Discovery lets the client use MTUs above 1281 bytes on most paths, keeping sessions stable across transitions such as moving from a 1500-MTU Wi-Fi network to a 1300-MTU cellular backhaul—without interrupting the application.
Resilience where connectivity is mission-critical
The practical impact shows up most clearly in environments where connectivity is non-negotiable. First responders using vehicle-mounted routers often traverse complex NAT and priority-routing layers that aggressively shrink available MTU. Without PMTUD, dispatch software can drop sessions during tower handoffs or signal fluctuations. Active discovery keeps the connection sticky, shielding the application from the network volatility underneath.
The same applies to hybrid workers: a traveler on hotel Wi-Fi behind double-NAT or legacy middleboxes may see choppy video calls and stalled transfers without this mechanism. With dynamic probing, the client identifies the bottleneck in seconds and optimizes packet flow before the user perceives a change.
Availability
Path MTU Discovery is available now for Cloudflare One Client users on the MASQUE protocol, for Windows, macOS, and Linux devices. Setup guidance is in the documentation.
Organizations new to Cloudflare One can onboard up to the first 50 users free by creating an account, downloading the Cloudflare One Client, and following the onboarding guide.
