Network & Infrastructure / IPv6, TCP & Transport Engineering
IPv6 PMTU black holes behind an ICMPv6 filter
A dual-stack application connects successfully but stalls when returning a larger response over IPv6. Small probes pass, leading the incident team to suspect the server instead of path-size feedback.
Environment and inputs: Dual-stack routed networks and transport endpoints; validate the complete path and the active operating-system version. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Compare IPv4 and IPv6 flows, response sizes, retransmissions and ICMPv6 Packet Too Big messages at both ends. Include tunnels and lower-MTU alternate links in the path inventory.
Explain the result
IPv6 routers do not fragment transit packets. Blocking required size feedback can prevent an endpoint from adapting, so successful small packets do not establish a usable application path.
Plan the fix
Permit the required ICMPv6 feedback under the reviewed security policy and correct inconsistent MTUs. Evaluate endpoint packetization-layer discovery where supported, rather than relying on an arbitrary global MSS reduction.
Check the result and rollback
Test payload sizes across normal and failover paths, checking that large transfers complete. Revert if policy changes expose unintended traffic or the path budget remains inconsistent.