Maximum Transmission Unit (MTU)
The Maximum Transmission Unit (MTU) is the largest size (in bytes) of a single protocol data unit that can be transmitted over a network link without fragmentation. In IP networking, it usually refers to the maximum size of a Layer 3 (Network Layer) packet—the IP header plus its payload—that an interface or network segment can carry.
Common Values
- Ethernet default MTU: 1,500 bytes
- Jumbo frames: typically 9,000 bytes, used in high-performance or storage networks
- Loopback interfaces: often much larger (e.g., 4,294,967,295 bytes on Windows)
What Happens When a Packet Exceeds the MTU
- Fragmentation — The IP layer splits the packet into smaller fragments, each under the MTU. Reassembly happens at the destination.
- Drop with ICMP — If the packet has the Don’t Fragment (DF) bit set, the router drops it and returns an ICMP "Packet Too Big" message.
Path MTU Discovery (PMTUD)
PMTUD is the process of discovering the smallest MTU along the entire path between two hosts. It relies on the DF bit and ICMP feedback to avoid fragmentation. If ICMP is blocked, PMTUD can fail and cause "black hole" connectivity problems.
Forensic Relevance
- Attackers may abuse IP fragmentation to evade detection, smuggle data, or bypass firewalls.
- Unusual MTU sizes or fragmentation patterns can indicate tunneling, covert channels, or malicious tooling.
- Understanding MTU helps interpret packet captures, trace connectivity failures, and validate whether observed traffic is physically plausible on a given link.