What is MTU
MTU (Maximum Transmission Unit) refers to the maximum PDU length that a layer interface can handle without triggering fragmentation. For IPv4, the common Ethernet link MTU is 1500 bytes; cellular interface MTU may have different default values provided by operators or module drivers. If an IoT terminal further encapsulates VPN, GRE, PPP, IPsec, or other tunnels on upper layers, the payload space is further reduced, creating a situation where the "logical MTU" is much smaller than 1500. If the application still sends large packets as if in a local network, these packets may be fragmented or dropped somewhere along the path.
The Cost of Fragmentation and Reassembly
IPv4 allows intermediate routers to fragment packets, but modern networks prefer end-to-end PMTUD (Path MTU Discovery) to dynamically discover the path MTU via ICMP "fragmentation needed" messages. If the cellular path or enterprise firewall blocks ICMP, PMTUD may fail, leading to TCP connections that "establish for small data but fail on large packets." IPv6 basically prohibits intermediate fragmentation, so oversized packets should be adjusted by the source. If the protocol stack of an IoT MCU has incomplete support for fragmentation and reassembly, occasional UDP packet loss may also occur.
Typical Symptoms in Cellular Scenarios
Common user phenomena include: HTTPS pages partially loading, MQTT large message failures, FTP can log in but cannot transfer large files. During troubleshooting, TCP MSS can be lowered, a smaller tunnel MTU can be set on the VPN side, or single-frame size can be limited at the application layer. For narrowband links like NB-IoT, operators may have stricter recommendations on packet size, which should be referenced in the module application manual. Debugging tools can use ping with the 'do not fragment' option to probe the maximum usable path size.
Engineering Recommendations
In the architecture design stage, reserve MTU margin for the "cellular + private network + cloud" link, for example, by centrally setting TCP MSS clamp on the VPN concentrator. Avoid assuming MTU is always 1500 in firmware; for protocols like CoAP and LwM2M, prioritize block transfer over a single large payload. Record the onsite operator and SIM batch because MTU policies might differ across APN exit devices.
The interface limit and the length inside a tunnel
The MTU of a hop is the largest packet that hop is willing to forward in one piece. The familiar 1500 bytes on Ethernet is a limit on the IP packet, not a payload the application may fill at will. Wrapping PPP, GRE, or IPsec outside it spends a fixed number of bytes on the outer header, and the usable inner length shrinks. The cellular access network’s own MTU may also be below 1500. A sender that still builds packets as it would on a local network is fragmented at some hop, or dropped because fragmentation is not allowed. IPv4 lets an intermediate router fragment. If reassembly fails, or only some fragments arrive, the whole packet is lost. IPv6 requires the source to control the length. Intermediate devices do not fragment in principle.
At design time, leave margin for “cellular plus tunnel plus cloud”: clamp the TCP MSS at the tunnel endpoint or the firewall, and limit the size of one UDP or private-protocol payload in the application. After the module dials, read the MTU the network provided. Do not compile it in as a constant. Narrowband access such as NB-IoT is more sensitive to packet length. An over-long certificate chain or uncompressed JSON triggers retransmission again and again.
A do-not-fragment probe dropped along the path
Path-MTU discovery depends on an ICMP or ICMPv6 “packet too big” response. After an enterprise firewall or the operator filters those messages, the TCP handshake still completes, because the handshake packets are small. As soon as a large segment carrying a certificate or an image is sent, the connection stalls. It looks like a server fault, and a path that does not go through the tunnel works again. If the application timeout is very short, retransmission starts before fragment reassembly finishes, and duplicate fragments appear on the air interface. A microcontroller stack that implements only unfragmented UDP loses the occasional large notify packet while the small heartbeat stays healthy, and the fault is assigned to the business server. Exit equipment on different APNs follows different policies. A lab card and a production card behave differently, and the firmware still shares one payload ceiling.
When investigating, find the largest size the current path will pass with fragmentation forbidden, then keep the application payload under that size. Look at IPv4 and IPv6 separately on dual stack; see cellular IPv6. A packet that can go out does not mean the outside network can connect back at the same MTU. The inbound direction is also constrained by NAT and private networks. Record the card batch and the APN, and do not write one exit’s measurement down as a constant for the whole live network.
Set a ceiling for each kind of message. Write heartbeats, telemetry, certificate chains, and firmware fragments separately. Do not share one “as large as possible” buffer. After a tunnel is turned on, measure the usable inner length again, and put that value in configuration rather than in a source constant. TCP clamps the maximum segment length at the endpoints. UDP and a private protocol must slice themselves. The stack will not shrink their payload for them. The reassembly buffer on a small-memory module is limited. A run of fragments also drops the normal packets that follow. For a comparison, use the same card and the same access point, send probes of increasing length, note the length of the first packet that fails, and leave margin below that as the application ceiling. Repeat the measurement after an operator change or an access-point name change.
Forbid fragmentation on the probe, grow from a short packet until it fails, and subtract a margin from the failing length to get the application ceiling. Repeat the measurement after a tunnel is enabled. Slice certificates and firmware images to that ceiling. Do not rely on an intermediate router to fragment them. Keep results for different access points separate. Do not write one card’s measurement as the default for every batch.
When small packets work and large packets fail, check the path length before the server. If the module does not have enough memory to reassemble, the symptom is an occasional lost notification while the heartbeat continues. That is not the same fault as a server that is down.