Frag needed and DF set (ICMP type 3 code 4) Networking Origin: Network OSI layer 3 · Network Last updated 5 Nov 2026

Networking: ping: local error: message too long, mtu=1500 / Packet needs to be fragmented but DF set

A packet is larger than the path MTU and is marked "don't fragment", so a router discards it.

Exact message you may see Frag needed and DF setPacket needs to be fragmented but DF setping: local error: message too long, mtu=1500Message too long mtuICMP fragmentation needed and DF set
Explore the map of this error Full error map →
Seen on: Linux Windows Networking

Meaning

Find the real path MTU with ping -M do -s 1472 host (Linux) or ping -f -l 1472 host (Windows) and lower the size until it works. Fix by setting a smaller MTU/MSS on the VPN or tunnel interface (e.g. 1400), or by allowing ICMP type 3 code 4 so path MTU discovery works.

Common causes

  • Tunnel/VPN/PPPoE with a smaller MTU than 1500
  • ICMP "fragmentation needed" blocked by a firewall
  • Jumbo frames enabled on only part of the path
  • Wrong MTU set on one interface
  • Overlay networks (VXLAN, WireGuard) adding headers

⚡ Quick fix

  1. Probe: ping -M do -s 1472 host
  2. Set MTU or MSS clamping (iptables ... --clamp-mss-to-pmtu)
  3. Allow ICMP type 3 code 4 through firewalls

Detailed fix by platform

Linux

  1. bash
    ping -M do -s 1472 -c 3 example.com
sudo ip link set dev wg0 mtu 1380

How to diagnose

  1. Largest ping size — Which passes?
  2. Tunnel MTU — Reduced?
  3. ICMP frag-needed — Allowed?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

1033 — Cloudflare Error 1033: Argo Tunnel error (Cloudflare Tunnel not connected) (Cloudflare)1033cloudflared Unable to reach the origin service — cloudflared: Unable to reach the origin service. The service may be down or it may not be responding to traffic from cloudflared (502) (Cloudflare)cloudflared Unable to…Connections hang on large transfers (PMTU black hole) — Networking: SSH/HTTPS connects but hangs on large data — path MTU discovery black hole (Networking)Connections hang on l…ICMP Destination unreachable (Port unreachable) — Networking: ICMP Destination unreachable (Port unreachable) — UDP packet sent to a port where nothing is listening (Networking)ICMP Destination unre…OSPF neighbor stuck in EXSTART/EXCHANGE — Networking: %OSPF-5-ADJCHG: Nbr 10.0.0.2 from EXSTART to DOWN — OSPF neighbor stuck in EXSTART/EXCHANGE (MTU mismatch) (Networking)OSPF neighbor stuck i…Ping: Request timed out — Networking: ping — Request timed out / 100% packet loss (host drops or filters ICMP) (Networking)Ping: Request timed o…PING: transmit failed. General failure. — Networking: PING: transmit failed. General failure. / ping: sendmsg: Operation not permitted (Networking)PING: transmit failed…Reply from 192.168.1.1: Destination host unreachable — Networking: ping — Destination Host Unreachable / Destination net unreachable (ICMP type 3) (Networking)Reply from 192.168.1.…Frag need…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.