Packet needs to be fragmented but DF set.
The packet is bigger than the path MTU
Seen in Windows ping -f -l, Linux ping (Frag needed and DF set, message too long)
You sent a packet with "Don't Fragment" set that is larger than the maximum packet size (MTU) on the path.
Common causes
- The ping size is larger than the link MTU: on standard 1500-byte Ethernet the biggest ping payload is 1472 bytes (1500 minus 28 bytes of headers).
- A tunnel on the path (VPN, PPPoE, GRE, IPsec) lowers the MTU below 1500.
- Connections that hang on large transfers while small requests work point to a path MTU problem with ICMP being blocked.
How to fix it
- Find the path MTU by lowering the size until it succeeds: `ping -f -l 1472 host` on Windows, `ping -M do -s 1472 host` on Linux, then add 28.
- Set the interface or tunnel MTU to that value, or clamp TCP MSS on the router or VPN gateway.
- Allow ICMP "fragmentation needed" messages through firewalls so path MTU discovery works.
Got a different message? Paste it into the error explainer.
Related errors
- Broken pipe · Wrote to a connection or pipe that was already closed
- Software caused connection abort · Your own system aborted the connection
- Destination host unreachable. · No path to the host could be found
- TTL expired in transit. · Packets ran out of hops before arriving
- PING: transmit failed. General failure. · Windows could not send the ping at all
- ECONNREFUSED · Connection refused
- ETIMEDOUT · Connection timed out
- ECONNRESET · Connection reset by peer
- EHOSTUNREACH · No route to host
- getaddrinfo ENOTFOUND · The hostname doesn't exist in DNS
- getaddrinfo EAI_AGAIN · Temporary DNS failure
- ENETUNREACH · Network is unreachable