How to Perform Path MTU Discovery on Linux and macOS (Ping and Tracepath)

Mismatched Maximum Transmission Unit (MTU) sizes across VPNs, tunnels (WireGuard, IPsec, PPPoE), and intermediate network links frequently cause silent TCP connection hangs and packet fragmentation issues. Testing your path's effective MTU using the "Don't Fragment" (DF) bit pinpoints the exact link threshold.

Formula: Total MTU = ICMP Payload Size + 28 bytes (20 bytes IP header + 8 bytes ICMP header).

1. Path MTU Discovery on Linux

Use ping with -M do (enforce Don't Fragment) or tracepath:

# Ping with 1472 bytes payload (1472 + 28 = 1500 MTU)
ping -M do -s 1472 8.8.8.8

# If it reports "Frag needed and DF set", step down until packets pass:
ping -M do -s 1392 8.8.8.8 # (1392 + 28 = 1420 MTU, standard for WireGuard)

# Automatic MTU trace across intermediate hops:
tracepath 8.8.8.8

2. Path MTU Discovery on macOS

# On macOS, use -D to set DF bit:
ping -D -s 1472 8.8.8.8