MTU basics — 1500 default, jumbo 9000, 802.1Q tag 4 bytes, IPv6 minimum 1280

MTU is the maximum size of a packet that can traverse a network segment without fragmentation. For an Ethernet router, the MTU defines the largest IP packet the interface will transmit or accept; a packet larger than the MTU is fragmented by the sender or dropped by the receiver. Getting MTU wrong is one of the most common causes of “the network works for small packets but not for big packets” — a failure mode that is invisible to a TCP SYN but breaks large file transfers, IPSec VPN, and any application that sends 64 KiB segments.

This lesson is the conceptual reference for Part LI: the canonical MTU values, the layer-2 vs layer-3 distinction, the IPv6 minimum, the 802.1Q overhead, and the VyOS 1.5 LTS configuration and validation commands.

The canonical MTU values

A VyOS 1.5 LTS operator must know these values without reference:

The “L3 MTU” is the size of the IP packet (including IP header). The “L2 MTU” includes the Ethernet header (14 bytes: 6-byte destination MAC + 6-byte source MAC + 2-byte EtherType) and the Ethernet trailer (4-byte FCS — Frame Check Sequence). So an Ethernet interface configured with MTU 1500 sends an L2 frame of 1518 bytes on the wire.

802.1Q VLAN overhead

An 802.1Q-tagged frame inserts a 4-byte VLAN tag between the Ethernet header’s source MAC and the EtherType. The tag identifies the VLAN (12-bit VLAN ID, so 4094 usable VLANs). The result:

flowchart LR
  subgraph UNTAGGED["Untagged Ethernet (1518 bytes)"]
    U1["DA<br/>6 bytes"] --> U2["SA<br/>6 bytes"]
    U2 --> U3["EtherType<br/>2 bytes"]
    U3 --> U4["Payload<br/>1500 bytes"]
    U4 --> U5["FCS<br/>4 bytes"]
  end
  subgraph TAGGED["802.1Q tagged (1522 bytes)"]
    T1["DA<br/>6 bytes"] --> T2["SA<br/>6 bytes"]
    T2 --> T3["TPID<br/>2 bytes"]
    T3 --> T4["TCI (VLAN)<br/>2 bytes"]
    T4 --> T5["EtherType<br/>2 bytes"]
    T5 --> T6["Payload<br/>1500 bytes"]
    T6 --> T7["FCS<br/>4 bytes"]
  end

The tagged frame is 4 bytes longer. Two consequences:

1. Wire MTU rises to 1522 bytes. Switches that support 802.1Q must accept 1522-byte frames. The default Ethernet MTU of 1500 (L3) still applies; the wire-level frame is 1522.
2. L3 MTU is unchanged. A 1500-byte IP packet fits inside a tagged frame with 4 bytes of header overhead; the IP packet itself is the same size. The operator does not reduce the L3 MTU because of 802.1Q.

The discipline: a VyOS sub-interface (eth0.100) carries 802.1Q tags. The L3 MTU remains 1500; the wire-level frame is 1522. The MTU configuration on the sub-interface is the same as on the parent interface.

IPv6 minimum

IPv6 requires every link to support an MTU of at least 1280 bytes (RFC 2460). If a link cannot deliver 1280 bytes (e.g., a low-bandwidth radio link), IPv6 cannot run on the link. For Ethernet, this is not a constraint; the default 1500-byte MTU exceeds 1280 by 220 bytes.

The IPv6 minimum has practical implications:

• Tunnels. A tunnel that wraps an IPv6 packet inside an IPv4 packet adds overhead. If the inner IPv6 packet is 1280 bytes and the tunnel overhead is 80 bytes, the outer IPv4 packet is 1360 bytes — within the 1500-byte Ethernet MTU. For larger inner IPv6 packets, the tunnel may exceed the path MTU.
• PMTUD floor. Path MTU Discovery cannot reduce the path MTU below 1280 for IPv6. If the discovered path MTU is below 1280, the IPv6 layer must fragment locally (or drop the packet).

flowchart LR
  INNER["Inner IPv6 packet<br/>up to path MTU"] --> TUN["Tunnel header<br/>IPv4 GRE = 24 bytes"]
  TUN --> OUTER["Outer IPv4 packet<br/>inner + tunnel overhead"]
  OUTER --> WIRE["Ethernet wire MTU 1500"]

If inner MTU + tunnel overhead > 1500, the outer packet does not fit on the wire. PMTUD must reduce the inner MTU. Part LI-02 covers tunnel overhead calculations in detail.

VyOS 1.5 LTS configuration

The operator configures the interface MTU:

configure
set interfaces ethernet eth0 mtu 9000
set interfaces ethernet eth0.100 mtu 1500
commit
save

The configuration is applied immediately on commit. The operator validates:

show interfaces ethernet eth0
# MTU 9000

show interfaces ethernet eth0.100
# MTU 1500

The Linux kernel reports the same values:

$ ip link show eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 ...

$ ip link show eth0.100
3: eth0.100@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 ...

Layer-3 MTU vs path MTU

The interface MTU is the maximum packet the interface will transmit. The path MTU is the maximum packet that can traverse the entire path from source to destination. The path MTU is the minimum of the interface MTUs along the path.

flowchart LR
  S["Source<br/>MTU 9000"] --> R1["R1<br/>MTU 9000"]
  R1 --> R2["R2<br/>MTU 1500"]
  R2 --> R3["R3<br/>MTU 1500"]
  R3 --> D["Destination<br/>MTU 9000"]

In this example, the source’s interface MTU is 9000 (jumbo) but the path MTU is 1500 (the bottleneck at R2 and R3). Any packet larger than 1500 bytes will be dropped at R2 or R3 unless the sender fragments it (or Path MTU Discovery lowers the source’s effective MTU — covered in Part LI-03).

The discipline: the operator who configures 9000 on the source but does not configure 9000 on every interface along the path will see the source sending jumbo frames that are dropped at the bottleneck. The fix is to align the MTU across the path, or to use PMTUD to let the source learn the bottleneck.

Production failure modes

The MTU-basics failure modes the operator encounters:

• Jumbo mismatch. Source sends MTU 9000; intermediate switch or router only supports 1500. Large packets are dropped silently. Fix: align MTU across the path; reduce the source MTU; or use PMTUD.
• 802.1Q MTU calculation error. Operator reduces the L3 MTU by 4 to account for the 802.1Q tag. The reduction is unnecessary; the 802.1Q tag adds to the wire-level frame, not to the L3 packet. Fix: keep the L3 MTU at 1500.
• IPv6 minimum violation. A tunnel that does not preserve the IPv6 1280 minimum. Inner IPv6 packets larger than 1280 must be fragmented or dropped. Fix: ensure the tunnel’s effective MTU is at least 1280 + tunnel overhead.
• MTU change disrupts live link. A commit raising the MTU causes a brief link-down. Operators on the same router console see the drop. Fix: commit-confirm 5; coordinate with the switch side.
• Different OS, different MTU default. Linux defaults to 1500; Windows defaults to 1500; some BSD defaults differ. Cross-vendor validation is required for end-to-end MTU.
• Jumbo on access port. A jumbo MTU on an access port (a port that connects to a server, not a switch-to-switch backbone) wastes buffer space for no benefit. Fix: 1500 on access ports, 9000 only on backbone ports.

Rollback

MTU changes are simple to roll back:

• commit-confirm 5 — auto-rollback restores the previous MTU if the link does not come back.
• set interfaces ethernet eth0 mtu <previous-value> and commit — manual rollback to the previous value.
• reboot — restores the boot-time MTU from the saved configuration; useful if the live configuration is corrupted.

Production discipline

Cross-course references

• Part VII-03 (VII-VyOS-Interfaces / MTU on interface) covers the basic MTU configuration.
• Part LI-02 (LI-VyOS-MTU / tunnel overhead) covers the MTU calculations for WireGuard, IPsec, GRE, and VXLAN.
• Part LI-03 (LI-VyOS-MTU / PMTUD) covers Path MTU Discovery and ICMP Frag Needed.
• Part LI-05 (LI-VyOS-MTU / MTU and fragmentation troubleshoot) covers the operational diagnostic for MTU mismatches.
• Part VIII (VIII-VyOS-VLANs) covers VLAN configuration, including the 802.1Q overhead implications.
• The Linux course’s V-Linux-NetConfig covers the Linux network stack’s MTU handling from the host perspective.

Quiz