Question 1677

The Vanishing Post

A client reaches an internal API through an IPsec tunnel whose path MTU is 1400 bytes. Small GET requests work. The TLS handshake completes normally. Any POST with a body above roughly 1.3 KB hangs and eventually times out.

A capture on the client shows the same full-size 1500 byte datagram with the DF bit set, retransmitted six times with no reply of any kind, and no RST. The corporate firewall drops all inbound ICMP.

What is happening?

A

The server already closed the socket, so the retransmissions are hitting a connection that no longer exists.

B

The tunnel router drops the oversized DF datagram and sends ICMP type 3 code 4 carrying the next-hop MTU. The firewall eats it, so the client never lowers its estimate.

C

The handshake completed, so the path is proven healthy; this is the server's application-level read timeout.

D

The receiver advertised a zero window, so the sender is stuck waiting for it to reopen.