Connections hang on large transfers (PMTU black hole) Networking Origin: Network OSI layer 3 · Network Last updated 5 Nov 2026

Networking: SSH/HTTPS connects but hangs on large data — path MTU discovery black hole

Small packets pass but full-size ones vanish, so logins work and then transfers or page loads stall.

Exact message you may see PMTU black holeSSH hangs after bannerconnection hangs on large packets MTUTLS handshake stalls Server Hello MTUpath MTU discovery blackhole
Explore the map of this error Full error map →
Seen on: Linux Networking

Meaning

A device on the path has a lower MTU and ICMP "fragmentation needed" messages are blocked, so the sender never learns to send smaller packets. Clamp the MSS on the tunnel/router, lower the interface MTU, or allow ICMP type 3 code 4. Typical signs: ssh stalls after the banner, TLS stalls at Server Hello.

Common causes

  • Firewall dropping ICMP type 3 code 4
  • VPN/tunnel MTU lower than the LAN MTU
  • PPPoE (1492) or cloud overlay overhead
  • MSS not clamped on the gateway
  • Mismatched MTU on one hop

⚡ Quick fix

  1. Test sizes: ping -M do -s 1400 host and step up
  2. Clamp MSS: iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
  3. Allow ICMP type 3

Detailed fix by platform

Linux

  1. sudo iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

How to diagnose

  1. Small requests — Work?
  2. Large transfers — Hang?
  3. ICMP type 3 — Allowed?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

Cannot assign requested address (EADDRNOTAVAIL) — Networking: connect: Cannot assign requested address — ephemeral port range exhausted by TIME_WAIT connections (Networking)Cannot assign request…Frag needed and DF set (ICMP type 3 code 4) — Networking: ping: local error: message too long, mtu=1500 / Packet needs to be fragmented but DF set (Networking)Frag needed and DF se…High TCP retransmissions / packet loss — Networking: netstat -s: segments retransmitted / Wireshark: TCP Retransmission, TCP Dup ACK — packet loss on the path (Networking)High TCP retransmissi…Many sockets in CLOSE_WAIT — Networking: Thousands of sockets in CLOSE_WAIT — the application is not closing its side of the connection (Networking)Many sockets in CLOSE…NO_PROPOSAL_CHOSEN (IPsec/IKE) — Networking: IKE: received NO_PROPOSAL_CHOSEN — IPsec peers can't agree on encryption, hash or DH group (Networking)NO_PROPOSAL_CHOSEN (I…OSPF neighbor stuck in EXSTART/EXCHANGE — Networking: %OSPF-5-ADJCHG: Nbr 10.0.0.2 from EXSTART to DOWN — OSPF neighbor stuck in EXSTART/EXCHANGE (MTU mismatch) (Networking)OSPF neighbor stuck i…Possible SYN flooding on port 80. Sending cookies. — Networking: TCP: request_sock_TCP: Possible SYN flooding on port 80. Sending cookies. Check SNMP counters. (Networking)Possible SYN flooding…TCP ZeroWindow / TCP Window Full — Networking: Wireshark: TCP ZeroWindow, TCP Window Full — the receiver can't keep up and tells the sender to stop (Networking)TCP ZeroWindow / TCP …Connectio…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.