Home/ Questions/Q 3339734
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-18T00:31:36+00:00

I was wondering if there is any way to tune (on a linux system),

  • 0

I was wondering if there is any way to tune (on a linux system), the MTU for a given socket. (To make IP layer fragmenting into chunks smaller that the actual device MTU).

When I say for a given socket, I don’t mean programatically in the code of the application owning the socket but rather externally, for example via a sysfs entry.

If there is currently no way do that, do you have any ideas about where to hook/patch in linux kernel to implement such a possibility ?

Thanks.

EDIT: why the hell do I want to do that ?

I’m doing some Layer3-in-Layer4 (eg: tunneling IP and above through TCP tunnel) tunneling. Unlike VPN-like solutions, I’m not using a virtual interface to achieve that. I’m capturing packets using iptables, dropping them for their normal way and writing them to the tunnel socket.

Think about the case of a big file transfer, all packets are filled up to MTU size. When I tunnel them, I add some overhead, leading in every original packet to produce two tunneled packets, it’s under-optimal.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    If the socket is created such that DF set on outgoing packets you might have some luck in spoofing (injecting) an ICMP fragmentation needed message back at yourself until you end up with the desired MTU. Rather ugly, but depending on how desperate you are it might be appropriate.

    You could for example generate these packets with iptables rules, so the matching and sending is simple and external to your application. It looks like the REJECT target for iptables doesn’t have a reject-with of fragmentation needed though, it probably wouldn’t be too tricky to add one.

    The other approach, if it’s only TCP packets you care about is you might have some luck with the socket option TCP_MAXSEG or the TCPMSS target if that’s appropriate to your problem.

    For UDP or raw you’re free to send() packets as small as you fancy!

    Update:

    Based on the “why would I want to do that?” answer, it seems like fragmenting packets if DF isn’t set or raising ICMP “fragmentation needed” and dropping would actually be the correct solution.

    It’s what a more “normal” router would do and provided firewalls don’t eat the ICMP packet then it will behave sanely in all scenarios, whereas retrospectively changing things is a recipe for odd behaviour.

    The iptables clamp mss is quite a good fix for TCP over this “VPN” though, especially as you’re already making extensive use of iptables it seems.

    • 0