techlist.io
KREN
cloudflare

Ending the "silent drop": how Dynamic Path MTU Discovery makes the Cloudflare One Client more resilient (opens in new tab)

cloudflarenetworkingquicencryptionpath-mtu-discoverymasque-protocolicmpnat-traversal

Cloudflare’s Dynamic Path MTU Discovery (PMTUD) helps prevent connections from silently failing when network paths cannot carry large encrypted packets. Using active probing through MASQUE and QUIC, the Cloudflare One Client determines the largest reliable packet size and adjusts its virtual interface accordingly. This makes applications more resilient across restrictive, changing networks without relying on ICMP error messages.

The PMTUD Black Hole Problem

  • Networks have a maximum transmission unit (MTU), typically 1500 bytes on Ethernet.
  • Encryption and security metadata reduce the space available for application data.
  • LTE/5G, satellite, public safety, and other specialized networks may support smaller MTUs, such as 1300 bytes.
  • Routers should send ICMP messages when packets are too large, but firewalls and middleboxes often drop those messages.
  • The sender continues transmitting oversized packets, leaving uploads, video calls, SSH sessions, or other applications stuck until they time out.

Active Path Discovery with MASQUE

  • Cloudflare implements RFC 8899 Datagram Packetization Layer PMTUD.
  • The Cloudflare One Client sends encrypted probes of different sizes to the Cloudflare edge.
  • By observing which probes arrive, it identifies the usable MTU without depending on blocked ICMP feedback.
  • Probing narrows the range from the supported maximum toward the precise path capacity.
  • The process runs in the background and is designed not to disrupt active connections.

Adapting to Changing Networks

  • The client dynamically changes its virtual interface MTU based on the discovered path.
  • It periodically revalidates the path, allowing it to respond when users move between networks.
  • For example, a connection can transition from 1500-byte Wi-Fi to 1300-byte cellular connectivity without interrupting application sessions.

Benefits for Critical and Everyday Connectivity

  • First responders can maintain stable CAD and other mission-critical connections across NAT layers, tower handoffs, and fluctuating signal conditions.
  • Hybrid workers benefit from fewer stalled transfers and more reliable video calls on hotel, cellular, and double-NAT networks.
  • The client hides much of the underlying network instability from applications.

Cloudflare One Client users running the MASQUE protocol can use PMTUD on Windows, macOS, and Linux at no additional cost.