In this article
A successful ping alongside a stalled large transfer is compatible with an MTU black hole. Small packets pass while larger packets disappear and the sender lacks the signal needed to adjust. Investigate PMTUD, ICMP and tunnel overhead before changing timeouts or GPUs.
A successful ping alongside a stalled large transfer is compatible with an MTU black hole. Small packets pass while larger packets disappear and the sender lacks the signal needed to adjust. Investigate PMTUD, ICMP and tunnel overhead before changing timeouts or GPUs.
Separate connection stages
Record whether DNS works, TCP connects and TLS or data transfer stops progressing. Ping tests a particular packet size and route, not arbitrary application payloads. Keep source and destination consistent: laptop traffic can differ from Pod traffic through an overlay or VPN. Preserve routes, interfaces, IP family and effective MTU on the segments you control.
Inspect the PMTUD mechanism
Path MTU Discovery can depend on ICMP notification when a packet cannot be forwarded. If that feedback is lost or filtered, TCP may retransmit without progress. The RFC describes this black-hole behavior. It is a network hypothesis, not a direct consequence of file size. TLS records, segmentation and offload complicate capture interpretation; a large captured packet is not automatically proof that an equally large frame traversed the wire.
Run a bounded comparison
In an illustrative test, a tunnel lowers usable path MTU. A short request succeeds while a synthetic large response stalls. Compare controlled sizes, retransmissions and ICMP at permitted observation points. Repeat on a test path without the tunnel. This can locate the boundary, but does not prescribe one MTU for every cloud and does not require customer data.
| Artifact | Diagnostic value |
|---|---|
| Source and destination | Defines the route under investigation |
| Interface MTU | Shows local configuration |
| ICMP observations | Checks PMTUD feedback |
| Retransmissions | Establishes lack of TCP progress |
Correct the confirmed segment
Align overlay and tunnel MTU and permit required ICMP for the IP family. Kernel tcp_mtu_probing has documented modes that may support mitigation, but does not replace understanding the network defect. Avoid blind global changes on a shared node. Save original settings and test separately. Congestion or application backpressure can cause other stalls that MTU changes will not repair.
Repeat the large transfer
Test small and large synthetic payloads through the same source, route and client after correction. Preserve duration, retransmissions and PMTUD observations. Recovery should survive reconnection without breaking another required route. The artifact links the symptom to a specific network segment. If the remaining failure occurs during certificate validation without evidence of data loss, investigate TLS separately. Similar outward symptoms do not establish one universal cause, and successful ping remains only a limited connectivity observation.
Record transfer direction: asymmetric routing can expose the issue only in server responses. A short uploaded request does not establish the same path or packet allowance for returning data.
Related operational reading: network and uptime; cloud egress model serving.