# Networking: ping: local error: message too long, mtu=1500 / Packet needs to be fragmented but DF set

**Code:** `Frag needed and DF set (ICMP type 3 code 4)` · **Category:** Networking · **Seen on:** Linux, Windows, Networking

A packet is larger than the path MTU and is marked "don't fragment", so a router discards it.

## Meaning

Find the real path MTU with `ping -M do -s 1472 host` (Linux) or `ping -f -l 1472 host` (Windows) and lower the size until it works. Fix by setting a smaller MTU/MSS on the VPN or tunnel interface (e.g. 1400), or by allowing ICMP type 3 code 4 so path MTU discovery works.

## Common causes

- Tunnel/VPN/PPPoE with a smaller MTU than 1500
- ICMP "fragmentation needed" blocked by a firewall
- Jumbo frames enabled on only part of the path
- Wrong MTU set on one interface
- Overlay networks (VXLAN, WireGuard) adding headers

## Quick fix

1. Probe: `ping -M do -s 1472 host`
2. Set MTU or MSS clamping (`iptables ... --clamp-mss-to-pmtu`)
3. Allow ICMP type 3 code 4 through firewalls

## Detailed fix by platform

### Linux

1. 

```bash
ping -M do -s 1472 -c 3 example.com
sudo ip link set dev wg0 mtu 1380
```


## How to diagnose

1. **Largest ping size** — Which passes?
2. **Tunnel MTU** — Reduced?
3. **ICMP frag-needed** — Allowed?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/networking/frag-needed-and-df-set-mtu)