AP Networking Exam PrepBuild • Secure • Troubleshoot • Verify
Packet Delivery • Phase 6

MTU, MSS & Path MTU Troubleshooting Practice Test

Practice 75 original MTU, MSS, and path MTU questions: packet budgets, tunnels, IPv4 DF, IPv6 Packet Too Big, black holes, captures, and verified repairs.

Published and updated October 20, 2026 · Free student and teacher resource · 25 Easy + 25 Medium + 25 Hard
Start the testRead the packet-size guide

Small packets working is the start of the investigation

Learn to distinguish an oversized IP packet, an excessive TCP segment, a tunnel budget, and a missing feedback message. These 75 original scenarios ask you to calculate a stated size, interpret the evidence, choose a narrow repair, and verify the transfer that actually failed.

Easy questions isolate one mechanism. Medium questions combine observations and size budgets. Hard questions introduce asymmetric paths, nested tunnels, partial repairs, capture artifacts, and conflicting results. These are independent instructional questions, not official Cisco or College Board exam items.

Start the interactive test · Read the troubleshooting guide · Choose another topic

Take the MTU, MSS, and path MTU practice test

Choose one answer to receive immediate feedback. Your first selection is scored; read the explanation before moving on. Use keyboard Tab to reach controls and arrow keys within the answer group. You can use these as untimed diagnostic practice, pausing to write your reasoning.

Changing difficulty or restarting clears the current attempt. Download your log first if you want to keep it.

Back to Top of Practice Test

Read all 75 prompts and choices

Open a prompt to inspect its choices. Its reference answer and explanation stay hidden until you select an answer for that item in the interactive test. Reference IDs stay fixed for classroom discussion and correction reports. Restarting or switching difficulty clears the current attempt and hides the revealed reference answers. Download your log first if you want to keep it.

Easy question library · 25 questions

Easy 1. What does a 1500-byte IP interface MTU limit on an ordinary Ethernet interface?
  1. Only the TCP application data
  2. The Ethernet frame including its link header
  3. The combined size of every packet in a flow
  4. The complete IP packet carried in one frame
Easy 2. A fixed route crosses IP links with MTUs of 1500, 1400, and 1500 bytes. What is its path MTU?
  1. 4400 bytes
  2. 1400 bytes
  3. 1500 bytes
  4. 1466 bytes
Easy 3. An IPv4 packet may occupy 1500 bytes. Its IP and TCP headers are each 20 bytes, with no options. How much TCP data fits?
  1. 1480 bytes
  2. 1440 bytes
  3. 1500 bytes
  4. 1460 bytes
Easy 4. For a 1500-byte IPv6 packet with a 40-byte base header, a 20-byte TCP header, and no extension headers or options, what TCP data budget remains?
  1. 1440 bytes
  2. 1460 bytes
  3. 1500 bytes
  4. 1480 bytes
Easy 5. In a TCP SYN sent by a laptop, what does its MSS option describe?
  1. The TCP data limit it advertises for receiving segments
  2. The maximum IP packet every internet route supports
  3. The amount of data it has already acknowledged
  4. The largest Ethernet frame its router forwards
Easy 6. An IPv4 router cannot forward a packet because it exceeds the next-link MTU and DF is set. What is the expected action?
  1. Increase the next interface MTU for this packet
  2. Return a TCP reset on behalf of the receiver
  3. Drop it and send ICMP fragmentation-needed feedback
  4. Clear DF and fragment the packet automatically
Easy 7. Which control message is central to conventional IPv6 Path MTU Discovery?
  1. ICMPv6 Neighbor Advertisement
  2. ICMPv6 Packet Too Big
  3. DNS response-size warning
  4. TCP window-update notification
Easy 8. Who can create IPv6 fragments when fragmentation is required?
  1. Only the final destination after delivery
  2. Any forwarding router with a smaller next link
  3. The source of the IPv6 packet
  4. Every switch between the two hosts
Easy 9. A tunnel adds exactly 60 bytes around an inner IP packet. Its outer IP path budget is 1500 bytes. What maximum inner IP size fits without outer fragmentation?
  1. 1500 bytes
  2. 1460 bytes
  3. 1440 bytes
  4. 1560 bytes
Easy 10. A small echo request receives a reply. What does this prove about a later 1500-byte application packet?
  1. It must fit because the destination replied once
  2. It cannot be filtered after the echo succeeded
  3. Its delivery still needs separate evidence
  4. It must follow the same forward and return routes
Easy 11. What does a TCP MSS-clamping rule normally modify?
  1. The payload length of every UDP datagram
  2. The MSS option in TCP connection-setup packets
  3. The maximum DNS record length in a reply
  4. The IP MTU of all remote routers
Easy 12. Why does a successful TCP three-way handshake not rule out a PMTU problem?
  1. Its small packets may fit where later data packets do not
  2. It causes all later IP packets to be fragmented
  3. It verifies DNS but never uses IP routing
  4. It measures the MTU of every link before sending data
Easy 13. Which description best matches a PMTU black hole?
  1. A router advertises a DNS server with a long hostname
  2. Oversized packets vanish while needed size feedback does not reach the sender
  3. A TCP peer advertises zero receive-window space
  4. Every packet is delivered but in a different order
Easy 14. An application sends UDP. Will rewriting TCP MSS options change its UDP datagram size?
  1. Yes; every transport reads the TCP SYN
  2. No; UDP packets never have an MTU constraint
  3. No; UDP has no TCP MSS negotiation
  4. Yes; MSS clamping reduces all IP packets
Easy 15. A trace reports an IPv4 Total Length of 1400 bytes. What is included?
  1. The IPv4 header plus its IP payload
  2. Only the IPv4 header and no payload
  3. Only the bytes following the TCP header
  4. The Ethernet preamble and frame trailer
Easy 16. A TCP segment carries a 32-byte TCP header, including options. Its IPv4 header is 20 bytes and its full IP packet must fit in 1500 bytes. What data length fits?
  1. 1468 bytes
  2. 1480 bytes
  3. 1448 bytes
  4. 1460 bytes
Easy 17. The sender retransmits a segment several times. What may you conclude from that alone?
  1. A router necessarily blocked ICMP feedback
  2. The receiver has an invalid certificate
  3. The path MTU is exactly 1400 bytes
  4. Delivery or acknowledgement is missing; the cause needs more evidence
Easy 18. A portal explicitly reports that the certificate does not match its hostname. What should that evidence initially direct you to?
  1. A larger Ethernet frame limit on the access switch
  2. A lower MSS on every campus client
  3. The UDP payload size of the DNS request
  4. The requested identity and presented certificate
Easy 19. On a directional A-to-B route, where must size feedback about a dropped A-to-B packet ultimately be delivered?
  1. To A, the source of the dropped packet
  2. Only to B, the intended recipient
  3. To every access switch on the return path
  4. Only to the DNS resolver for B
Easy 20. An inner IPv4 UDP packet has a 20-byte IP header and an 8-byte UDP header. If its full IP budget is 1400 bytes, how much UDP payload fits?
  1. 1400 bytes
  2. 1372 bytes
  3. 1380 bytes
  4. 1360 bytes
Easy 21. Which quantity can legitimately differ between A-to-B and B-to-A traffic?
  1. The path MTU
  2. Whether TCP data excludes its TCP header
  3. The number of bytes in a stated 20-byte header
  4. The meaning of the IPv4 DF bit
Easy 22. Why record whether a capture is taken inside or outside a tunnel?
  1. The outer packet includes overhead absent from the inner view
  2. Only the inside view contains source and destination addresses
  3. The outside view never contains IP packets
  4. The capture location changes the definition of a byte
Easy 23. A host capture shows a very large outbound TCP object before NIC segmentation. What should you check before calling it an oversized wire packet?
  1. The number of DNS aliases for the server
  2. The receiving user account password
  3. The web page title and browser bookmark
  4. Segmentation offload and a wire-side observation
Easy 24. A router receives a 1500-byte IPv4 packet with DF clear for a 1400-byte next link. Which behavior is permitted by IPv4?
  1. Convert it into an IPv6 packet automatically
  2. Forward it unchanged because DF is clear
  3. Remove its TCP header to make it fit
  4. Fragment it if forwarding and policy permit
Easy 25. After correcting a tunnel MTU, which check best verifies the reported problem is resolved?
  1. Repeat only the smallest successful ping
  2. Repeat the original large transfer and inspect its delivery
  3. Confirm the login page title looks unchanged
  4. Check that the switch still has a MAC address table

Medium question library · 25 questions

Medium 1. A tunnel accepts 1420-byte inner IPv4 packets. With 20-byte IP and TCP headers and no options, which TCP data ceiling fits that inner limit?
  1. 1420 bytes
  2. 1380 bytes
  3. 1400 bytes
  4. 1460 bytes
Medium 2. A Linux iputils IPv4 ping uses -s 1472. Assume a 20-byte IPv4 header, an 8-byte ICMP header, and no options. What full IP length is tested?
  1. 1500 bytes
  2. 1492 bytes
  3. 1480 bytes
  4. 1472 bytes
Medium 3. A 1500-byte IPv4 DF probe gets a fragmentation-needed response naming 1380 bytes. A 1380-byte probe succeeds. What is supported for the tested path?
  1. Every route to the destination has exactly a 1380-byte MTU
  2. A 1380-byte IP packet was delivered; 1500 exceeded a reported limit
  3. The maximum TCP payload is necessarily 1380 bytes
  4. The application certificate caused the larger probe to fail
Medium 4. Uploads work, but downloads stall after a tunnel change. Small responses pass in both directions. Which comparison should be added first?
  1. Server-to-client packet sizes and feedback versus the upload direction
  2. The server certificate issuer versus the tunnel interface name
  3. Only the size of the saved file on the client disk
  4. Only client-to-server SYN timing versus DNS TTL
Medium 5. The client SYN advertises MSS 1460. The server SYN-ACK advertises MSS 1360. With no other constraint, which peer is being told to cap data at 1360?
  1. Both peers in every UDP conversation
  2. Neither peer until DNS is queried again
  3. The server when sending to the client
  4. The client when sending to the server
Medium 6. A gateway clamps only client SYN MSS from 1460 to 1360. New downloads work, but uploads still use large packets. What explains the direction?
  1. The changed client advertisement limits only client data toward the server
  2. The changed client advertisement limits server data toward the client
  3. An MSS rewrite changes UDP but cannot affect downloads
  4. The gateway has reduced both endpoints’ interface MTUs automatically
Medium 7. An IPv6 PTB reaches a sender with a valid reported MTU of 1400. What should conventional PMTUD enable next?
  1. A change to the DNS AAAA record length
  2. Smaller source packets suitable for that path
  3. A permanent ban on all packets to the destination
  4. Fragmentation by the router that sent the PTB
Medium 8. A browser validates TLS, fetches a 1 KB page, then stalls on a large attachment. Which evidence would most strengthen a PMTU hypothesis?
  1. Repeated large data packets disappear while smaller packets pass on the same flow path
  2. A different browser uses another default download folder
  3. The attachment has a longer filename than the page
  4. The server’s certificate expires six months from now
Medium 9. A host capture displays a 16 KB TCP object; a downstream tap shows ten packets no larger than 1500 IP bytes with matching data. How should the views be reconciled?
  1. The interface MTU must secretly be 16384 bytes
  2. The tap must have lost every oversized Ethernet frame
  3. Host-side segmentation offload can explain the large captured object
  4. The TCP MSS negotiation was necessarily ignored
Medium 10. A 1440-byte inner packet enters a tunnel adding exactly 80 bytes. The outer path permits 1500 bytes and forbids fragmentation. What must change for it to fit?
  1. Increase TCP MSS by 20 bytes
  2. Reduce the outer packet limit to 1480 bytes
  3. Remove only 8 bytes of inner payload
  4. Reduce the inner packet by at least 20 bytes
Medium 11. A firewall allows echo replies but drops ICMPv4 Type 3 Code 4 toward clients. What failure can this introduce?
  1. Clients will automatically increase the correct path MTU
  2. The firewall must also be dropping all DNS traffic
  3. Clients may miss size feedback even though ping replies arrive
  4. Every TCP handshake must fail before any SYN-ACK
Medium 12. A peer advertises MSS 1460, but a discovered IPv4 PMTU is 1400. IP and TCP headers are 20 bytes each with no options. What maximum TCP data fits both constraints?
  1. 1400 bytes
  2. 1480 bytes
  3. 1460 bytes
  4. 1360 bytes
Medium 13. A team lowers MSS and tests an already established TCP session without reconnecting. Why is the result inconclusive about the new rule?
  1. An MSS rule modifies only the DNS query that precedes setup
  2. The session’s setup may have occurred before the MSS rewrite
  3. Existing sessions must always become smaller immediately
  4. TCP MSS is renegotiated in every acknowledgement
Medium 14. An IPv6 UDP packet must fit 1280 bytes. It has a 40-byte base header, 16 bytes of extension headers, and an 8-byte UDP header. What UDP payload fits?
  1. 1240 bytes
  2. 1216 bytes
  3. 1232 bytes
  4. 1256 bytes
Medium 15. Large DNS answers over UDP fail across a tunnel, while short answers succeed. Why is TCP MSS clamping alone an incomplete repair?
  1. A DNS answer never includes transport or IP overhead
  2. It does not change the failing UDP response sizes or their delivery
  3. UDP automatically fragments itself before IP processing
  4. DNS uses only TCP port 443 for long answers
Medium 16. A packet capture shows repeated TCP zero-window advertisements from a receiver while packets stay below the known path limit. What should you investigate first?
  1. A larger sender MSS to fill the network faster
  2. A blocked IPv6 PTB on an IPv4-only session
  3. Receiver buffering and application consumption
  4. The Ethernet preamble counted as TCP data
Medium 17. The same service works over IPv4 but its IPv6 large transfer fails. What is the most useful next isolation step?
  1. Reuse the IPv4 MSS budget without accounting for IPv6 headers
  2. Assume the IPv4 result proves the IPv6 route MTU is correct
  3. Delete every AAAA record before collecting any IPv6 evidence
  4. Test IPv6 packet sizing and ICMPv6 feedback on the actual failing route
Medium 18. A router sends a valid fragmentation-needed message, but a sender capture never sees it. Which boundary needs investigation?
  1. Only the next-link cable that carried the successful small probe
  2. Only the receiver’s file permissions after delivery
  3. The TCP window scale advertised by the receiver
  4. The feedback return path and filtering between router and sender
Medium 19. An IPv4 flow has no packet loss at 1200 bytes, intermittent loss at 1300, and heavy loss at 1400 during peak load. What is justified?
  1. Collect repeated controlled measurements before assigning a size threshold
  2. The path MTU is proved to be exactly 1300 bytes
  3. Congestion cannot affect differently sized tests
  4. All 1300-byte packets are too large by definition
Medium 20. A trace lists frame length 1514 and IPv4 Total Length 1500, excluding a captured FCS. Is this evidence of exceeding a 1500-byte IP MTU?
  1. Yes; the correct IP limit must be 1486 here
  2. Yes; all frame bytes count toward the IP MTU
  3. No; the extra 14 bytes are the Ethernet header in this view
  4. No; IPv4 Total Length omits the IPv4 header
Medium 21. A VPN’s overhead varies with encapsulation and padding. Which sizing method is defensible?
  1. Determine the applicable overhead bounds and verify actual outer packets
  2. Use the smallest overhead observed and assume it never grows
  3. Choose an MSS equal to the outer interface MTU
  4. Subtract a universal 40 bytes for every VPN implementation
Medium 22. A large write succeeds after reducing application chunk size, but no packet capture was collected. What should the incident note say?
  1. The receiver MSS was definitely rewritten by the application
  2. A successful small chunk proves ICMP feedback is flowing
  3. The path MTU equals the new application chunk size
  4. The workaround helped; the packet-level cause remains unverified
Medium 23. The NIC supports jumbo frames, but a WAN hop has IP MTU 1500. What follows for an unfragmented packet across the full route?
  1. The TCP receive window becomes the WAN MTU
  2. Jumbo capability makes every WAN hop accept jumbo packets
  3. It still must fit the smaller WAN constraint
  4. The largest NIC MTU overrides the smallest link MTU
Medium 24. An operator changes MTU, firewall policy, and DNS together, then the upload works. What is missing from the causal claim?
  1. An isolated comparison showing which changed condition restored delivery
  2. A larger sample of unrelated hostname spellings
  3. A guarantee that all three changes were necessary
  4. Proof that the browser saved its homepage bookmark
Medium 25. For a known failing destination, why test both an affected host and a nearby working host while recording their routes?
  1. Matching subnet masks guarantee identical encapsulation
  2. Nearby hosts must share identical PMTU caches
  3. Different paths or tunnel use can explain the contrast
  4. Only the working host can receive ICMP errors

Hard question library · 25 questions

Hard 1. A client upload crosses an IP tunnel with a 1500-byte outer limit and exactly 72 bytes overhead. The client sends inner IPv4/TCP with 20-byte headers and no options. The server advertises MSS 1460. Which data ceiling respects both limits?
  1. 1388 bytes
  2. 1428 bytes
  3. 1360 bytes
  4. 1460 bytes
Hard 2. In a controlled flow, inner packets above 1420 disappear at tunnel ingress. Router feedback appears outside, but the inner sender receives none. What repair verification is most relevant?
  1. Verify tunnel error handling delivers usable size information to the inner sender
  2. Show that the remote server can resolve the client hostname
  3. Verify only that the sender received an earlier SYN-ACK
  4. Show that the outer interface alone can ping its local gateway
Hard 3. A TCP download fails with large server segments. The team clamps only the server SYN-ACK advertisement; the new handshake shows that rewrite, yet downloads still fail. What did they target?
  1. The client’s sending limit, while the server’s download data needs investigation
  2. The IPv6 router’s permission to fragment transit traffic
  3. The client’s UDP receive limit for this TCP connection
  4. The server’s sending limit, proving all download packets fit
Hard 4. After MSS clamping, new TCP downloads pass through a 1400-byte path. A UDP video sender still emits 1450-byte full IPv4 packets with DF set and receives no feedback. Which completion claim is valid?
  1. The whole network is repaired because both applications use IP
  2. The TCP mitigation worked, but UDP still needs a separate size and feedback repair
  3. The video sender should inherit MSS from the passing TCP download
  4. The UDP packet fits because 1450 is smaller than Ethernet’s frame size
Hard 5. A 1500-byte IPv4 DF probe succeeds to a public echo target. The application follows a different policy route through a 1420-byte tunnel. What does the successful probe establish?
  1. That the application tunnel must also accept 1500 IP bytes
  2. Delivery on the probe route, not the application’s usable size
  3. That policy routing cannot influence PMTU testing
  4. That reducing the application packet size would be pointless
Hard 6. An IPv6 connection receives a validated PTB reporting 1400. Its packets include a 40-byte base header, 24 bytes of extension headers, and a 32-byte TCP header. What TCP data fits the new path budget?
  1. 1360 bytes
  2. 1328 bytes
  3. 1340 bytes
  4. 1304 bytes
Hard 7. A service fails only on one ECMP path: a tunnel there permits 1380-byte inner IP packets, while another path permits 1500. A tester runs each probe using a new flow. What limitation should be reported?
  1. Every alternating success proves random receiver buffer exhaustion
  2. ECMP makes PMTU irrelevant because packets are spread evenly
  3. The 1500-byte success overrides every 1380-byte bottleneck
  4. Flow changes may select different paths, obscuring a single-flow size boundary
Hard 8. Small requests pass through an HTTPS proxy. Large responses from the proxy to a backend stall; public client-to-proxy captures remain healthy. Where should the next size test run?
  1. Only against the public proxy certificate chain
  2. Only between the client and its campus DNS resolver
  3. On the proxy-to-backend leg with its own packet and feedback context
  4. On the client leg using larger browser cache files
Hard 9. A sender capture shows retransmissions and bad outbound checksums. A wire tap shows valid checksums but confirms large DF packets stop at a smaller link; fragmentation-needed messages are blocked. Which interpretation fits both views?
  1. The blocked feedback must be a capture artifact because offload exists
  2. The host checksum warning alone proves the tunnel corrupts data
  3. Checksum offload explains the host warning; the independent size evidence still supports a PMTU fault
  4. The valid wire checksums prove all large packets reach the receiver
Hard 10. Two tunnel layers add exactly 48 and 64 bytes to the same packet, with no other overhead. The ultimate outer path limit is 1500. Inner IPv4/TCP headers total 40 bytes without options. What TCP data fits?
  1. 1388 bytes
  2. 1348 bytes
  3. 1436 bytes
  4. 1460 bytes
Hard 11. A backup path reduces PMTU from 1500 to 1380 during an established transfer. SYN MSS values remain unchanged. Why can the sender still need to reduce its data size?
  1. A TCP MSS option guarantees the path never changes
  2. The old handshake forces every segment to stay at maximum size
  3. Path constraints can tighten after the receiving MSS was advertised
  4. Only a new DNS lookup can permit smaller TCP segments
Hard 12. A router emits PTB messages for a 1400-byte IPv6 bottleneck. They reach the host NIC, but the application continues retransmitting 1480-byte IP packets. What must be checked beyond the network firewall?
  1. Whether IPv6 routers can be configured to fragment these transit packets
  2. Whether the application’s DNS name contains more than 1400 characters
  3. Whether the host validates, associates, and applies that feedback to the flow
  4. Whether lowering the Ethernet preamble changes the IPv6 base header
Hard 13. A forged-looking PTB names an unrelated flow and a much smaller MTU. What is the appropriate troubleshooting principle?
  1. Drop all future ICMPv6 messages regardless of their relationship
  2. Rewrite all TCP MSS values to the smallest number ever received
  3. Accept every claimed MTU because smaller packets are always harmless
  4. Validate relevance before using feedback to change a flow’s PMTU
Hard 14. In repeated controlled tests, 1400-byte IPv4 DF packets pass and 1401-byte packets trigger matching fragmentation-needed feedback. What TCP data fits with a 24-byte IPv4 header and a 32-byte TCP header?
  1. 1344 bytes
  2. 1400 bytes
  3. 1348 bytes
  4. 1360 bytes
Hard 15. A local workaround sets the sender MTU to 1280. Transfers pass, but the documented route can carry 1420 and valid feedback was previously filtered. What is the defensible closure note?
  1. A conservative local limit guarantees full-size transfers on every standby route
  2. Service works with a conservative limit; the feedback defect still needs repair
  3. Successful transfers prove the original ICMP filtering has been corrected
  4. The workaround proves the route now has an exact 1280-byte path MTU
Hard 16. An app sends a 4 KB write on a TCP socket. The wire shows several IP packets at or below 1380 bytes and successful acknowledgements. Why is the write not proof of an MTU violation?
  1. TCP data has no headers once the handshake succeeds
  2. Every application write is exactly one IP packet
  3. TCP can split the byte stream independently of application write boundaries
  4. MTU constrains only ICMP and never TCP
Hard 17. A QUIC-based transfer over UDP stalls after a path change. A TCP download on the same hosts works after MSS clamping. Which next investigation fits?
  1. The receiver’s TCP window scale for QUIC data
  2. The TCP SYN option used by the QUIC handshake
  3. The QUIC implementation’s datagram sizing and path-size discovery
  4. The TLS certificate size as a replacement for UDP packet sizing
Hard 18. A trace sees a 1400-byte inner IPv6 packet and a 1460-byte outer packet. A student subtracts the 60-byte encapsulation again from the inner length before checking a 1400 inner limit. What is wrong?
  1. The outer packet must contain no IP header
  2. IPv6 MTU counts only transport payload bytes
  3. An inner packet is always larger than its outer packet
  4. The inner measurement already excludes the outer encapsulation
Hard 19. A failover drill tests only login and a short API response. The standby route has a smaller MTU and blocked feedback. Large exports later fail. Which change makes acceptance representative?
  1. Extend certificate validity while leaving the standby data path untested
  2. Exercise large exports in both directions through the standby route
  3. Repeat the short API call more often on the primary route
  4. Count a completed SYN exchange as the maximum-size test
Hard 20. After a size repair, a fresh flow works but an older flow remains slow and emits smaller packets. What should be inspected before raising the global MTU again?
  1. Only the browser’s tab title during the transfer
  2. The Ethernet address length advertised by the server
  3. Whether the new file has fewer characters in its name
  4. Per-destination or flow path state and the old session’s recovery behavior
Hard 21. A monitoring agent checks ICMP reachability from the data center. Users fail on VPN uploads with an inner 1420-byte limit. Which monitoring addition addresses this blind spot?
  1. A representative VPN transfer with packet-size and feedback observations
  2. A second tiny echo probe from the same data-center source
  3. An HTTPS title check against an unrelated public page
  4. A DNS lookup that avoids the VPN tunnel
Hard 22. A reported 1500-byte packet is discarded on a 1492-byte IPv4 link with DF set. The resulting 1492-byte retransmission still fails at a later 1400-byte hop. What does this illustrate?
  1. Two size reports prove duplicate addressing at the sender
  2. The source must ignore the second router because the first report was valid
  3. The first MTU report guarantees every remaining hop is at least 1492
  4. PMTUD may need successive feedback as tighter constraints are encountered
Hard 23. An IPv6 sender uses packets below 1280 IP bytes and they still fail, while small echo succeeds. A teammate says IPv6’s minimum link MTU proves size handling cannot be involved. What is the defensible response?
  1. Assume the echo reply measured the complete application path
  2. Conclude every IPv6 link is physically guaranteed to deliver every sub-1280 packet
  3. Check actual forwarding, tunnel adaptation, policy, and feedback rather than treating the minimum as delivery proof
  4. Configure transit IPv6 routers to fragment until all traffic fits
Hard 24. The upload now completes after restoring relevant ICMP feedback. What evidence most directly confirms the intended PMTUD mechanism, beyond the application outcome?
  1. An unchanged DNS cache entry and a successful small echo
  2. Matched size feedback followed by smaller packets and advancing acknowledgements on the affected flow
  3. The same MSS in the original SYN and no later packet capture
  4. A firewall configuration screenshot without a repeated transfer
Hard 25. A class must explain why an MTU repair is preferable to disabling certificate validation for a stalled upload. TLS validates, a size boundary is reproducible, and blocked PMTU feedback is captured. Which reasoning is strongest?
  1. Repair the demonstrated size-feedback failure and keep identity validation enabled
  2. Replace DNS because every upload begins with a name lookup
  3. Use a passing homepage response as proof that the upload never failed
  4. Disable validation because smaller packets cannot carry certificates

Start with the byte boundary, then name the constraint

A report that “large packets fail” is missing its most important detail: large at which layer? Interface MTU usually describes the largest complete IP packet carried over that interface without IP fragmentation. It includes the IP header. TCP MSS describes TCP data, excluding TCP and IP headers. An Ethernet frame adds link-layer bytes around its IP packet. A screenshot showing 1514 frame bytes beside a 1500-byte IPv4 Total Length is not, by itself, an oversize-IP finding.

Write the unit beside every number in your notes. Use “1400-byte complete inner IP packet,” “1360 bytes TCP data,” or “1472 bytes ICMP echo data.” That small habit prevents a common error: subtracting a header twice because two tools label their size fields differently. When a question supplies header sizes, use those sizes. Real IPv4 and TCP headers can contain options, and IPv6 can carry extension headers.

The path MTU is the constraining IP-packet size along a particular direction and route. A laptop interface can accept 1500 while a later tunnel allows only 1420 inner IP bytes. Nothing about the local interface’s configured value removes that later limit. The reverse route may have a different constraint. For the underlying layer model, revisit OSI and encapsulation practice; label the packet boundary before doing any subtraction.

Swipe horizontally to compare the complete size budgets.

Stated complete IP budgetStated headersRemaining transport data
1500 bytes, IPv420 IP + 20 TCP; no options1460 TCP bytes
1500 bytes, IPv640 IPv6 + 20 TCP; no extensions or options1440 TCP bytes
1420 bytes, inner IPv420 IP + 32 TCP, including options1368 TCP bytes
1400 bytes, IPv640 IPv6 + 16 extensions + 8 UDP1336 UDP bytes

MSS is an advertisement with a direction

Read the MSS option as a receiving statement from the endpoint that sends it. When a client advertises MSS in its SYN, it tells the server about the client’s receiving limit. That option influences the server’s data toward the client. The server’s SYN-ACK advertisement influences the client’s data toward the server. Writing both arrows beside a handshake is often more useful than memorizing “clamp MSS to fix VPNs.”

The advertised value is an upper bound. It does not promise that every intermediate link can carry a segment of that size, and it does not require the sender to fill every segment. A sender must combine peer limits with its effective path constraints. If an IPv4 path permits 1400 IP bytes and both headers are 20 bytes without options, 1360 TCP data bytes fit even when the peer advertised 1460.

Keep advertised MSS arithmetic separate from actual packet arithmetic. RFC 6691 explains that the advertised MSS uses fixed IP and TCP headers; the sender reduces actual data for the options it includes. A 1500-byte IPv4 budget with a 20-byte IP header and 32-byte TCP header leaves 1448 bytes for that packet’s TCP data. Do not subtract options from the advertised limit and then blindly subtract those same options again during transmission. The TCP and UDP transport test helps separate segment size, receive-window limits, acknowledgements, and retransmission behavior.

Follow the feedback all the way to the source

For conventional IPv4 PMTUD, the sender uses DF so an oversized packet cannot simply be fragmented by a forwarding router. A router facing a smaller next-link limit drops the packet and reports fragmentation needed through ICMP Type 3 Code 4. The source can use that information to reduce its sending size. A second, smaller link farther along may trigger another reduction. The first discovered limit is not a certificate that all later links are equally large.

IPv6 forwarding routers do not fragment transit packets. They report the problem with ICMPv6 Packet Too Big, and the source adjusts. If IPv6 fragmentation is used, the source creates fragments with a Fragment header. IPv6’s minimum link MTU requirement does not guarantee a faulty deployed tunnel or firewall will deliver every packet below that number; investigate the implementation and link adaptation when evidence contradicts expected behavior.

Check both feedback generation and feedback delivery. Seeing the router emit an error does not prove the sender received it. Seeing a packet at the sender’s NIC does not prove its stack accepted it as relevant to the affected flow. Correlate the quoted packet, endpoints, timing, and resulting packetization. The narrow acceptance question is: did usable feedback reach the responsible sender and cause packets that now traverse the constraint?

Apply the Evidence • 120 Missions

Trace the packet before selecting the repair

A small request and a stalled upload make a useful evidence puzzle. The Browser Troubleshooting Simulator gives students 120 missions for collecting observations, selecting a repair, and verifying the required result. Use it to practice the investigation habits behind these packet-size questions.

AP Networking Browser Troubleshooting Simulator
$29.99
120 Missions • 60 Failure Patterns • Offline Copy
BUY NOW — INSTANT ACCESS → See all 120 missions & features

Build a PMTU case from several observations

A small ping, a completed TCP handshake, and a working login page can coexist with an MTU failure. Those transactions may use packets that fit. A later attachment, upload, or backend response can introduce larger packets. That pattern is a reason to test size handling; it is not enough to diagnose it. Application timeouts, receiver buffering, loss, and policy can create similar symptoms.

A stronger case connects a reproducible packet-size boundary to forwarding evidence. On a controlled route, smaller packets pass, larger DF packets stop at a known constraining hop, and relevant feedback is generated but filtered. Record the exact IP lengths and repeat the comparison. Intermittent loss that grows during busy periods deserves a different investigation from a stable one-byte size boundary that repeatedly triggers matching errors.

Separate specific errors from vague symptoms. A browser that explicitly reports a hostname mismatch has direct identity evidence; consult the HTTPS and TLS troubleshooting test. A receiver advertising zero window points toward buffering or application consumption. For broader loss patterns, use packet-loss troubleshooting and the monitoring and performance questions. Choose the explanation that accounts for the actual observations, including the ones your favorite theory cannot explain.

Mixed Review • Exams and Artifact Labs

Compare size failures with their lookalikes

An MTU diagnosis is stronger when students can explain why routing, policy, or receiver behavior fits less well. The Complete Exam Prep Vault combines practice exams, questions, and artifact labs for revisiting those neighboring decisions.

AP Networking Complete Exam Prep Vault
$39.99
BUY NOW — INSTANT ACCESS → See the Exam Prep Vault contents →
4 Practice Exams • 320 MCQs • 60 Artifact Labs

Budget tunnels from the outside inward

Suppose the outer path accepts 1500-byte IP packets and the specified encapsulation adds exactly 72 bytes around each complete inner IP packet. The inner budget is 1428. For inner IPv4/TCP with two 20-byte headers and no options, 1388 bytes remain for TCP data. State all three boundaries in the calculation: 1500 outer IP, 1428 inner IP, 1388 TCP data. A value without its layer is easy to apply to the wrong interface or field.

Nested encapsulation needs every applicable overhead included. Variable overhead needs the actual implementation’s bounds, including padding where relevant. Avoid a universal VPN subtraction: a number copied from one tunnel protocol can be wrong for another. Conversely, do not subtract overhead from a measured inner packet that already excludes the outer headers. Compare an inner measurement with an inner limit and an outer measurement with an outer limit.

A proxy adds another distinction: separate transport connections. A browser-to-proxy path and a proxy-to-origin path can have different packet budgets and independent feedback. Test from the endpoint that actually originates the failing leg. A healthy public connection cannot establish that the proxy’s backend transfer works. The routing and default-gateway test provides more practice with direction, next hops, and return-path evidence.

300 Bell Ringers • Teacher Answers

Put a byte budget on the board

Ask students which headers belong inside a stated limit before they reach for a calculator. The 300 Bell Ringers pack provides classroom starters and teacher answers for building the foundations that longer troubleshooting work depends on.

300 AP Networking Bell Ringers
$74.99
BUY NOW — INSTANT ACCESS → See what is included in the 300 Bell Ringers →
Instant Access • Full-Year Teacher Resource

Choose a probe that preserves the failing context

Before using a tool’s size option, check what it counts. In Linux iputils ping, -s specifies ICMP data bytes. With a 20-byte IPv4 header and 8-byte ICMP header, ping -4 -M do -s 1472 destination requests a 1500-byte IPv4 echo packet. This is a Linux iputils example, not a portable command for every operating system. Local cached PMTU can also affect whether the requested probe is sent, so distinguish a local size error from a router’s received feedback.

Use a permitted destination and a modest count, then compare several sizes around the observed boundary. Keep the source interface, destination, address family, policy route, and timing recorded. A public echo target outside the VPN is not a substitute for an application inside it. Echo traffic may also receive different policy treatment from TCP or UDP. The result describes the exchange you tested, including its return path, rather than proving every workload shares that limit.

When multiple paths are available, new flow identifiers may select different routes. A sweep that changes the flow on every probe can mix a 1380-byte path with a 1500-byte path and produce misleading results. Correlate tests with route evidence and repeat the real transfer. Make one controlled change when practical; if you change MTU, DNS, and filtering together, successful recovery cannot identify which condition mattered.

Teacher Feedback • Claims and Evidence

Grade the evidence behind the MTU claim

Have students identify the failing direction, label the packet size, and propose an acceptance test. The Artifact Analysis Grading Copilot helps teachers review written reasoning and prepare focused feedback while keeping the final grading decision.

AP Networking Artifact Analysis Grading Copilot
$49.99
8 Criteria • 5 Task Modes • Offline Premium Copy
BUY NOW — INSTANT ACCESS → See the free Copilot preview

Read captures without inventing wire behavior

Start capture notes with location: host before segmentation, wire tap, tunnel inner interface, or tunnel outer interface. Segmentation offload can make a host capture display a large TCP object that the NIC later divides into ordinary wire packets. Receive aggregation can similarly present combined data. A local checksum warning can occur before hardware calculates the checksum. These effects explain some strange captures, but they do not excuse a real oversized packet observed downstream.

Use independent evidence to reconcile views. Match the stream, sequence range, timing, and byte count at two observation points. If the wire shows correctly sized packets delivering the host object’s data, the large host entry does not establish jumbo-frame leakage. If the wire instead shows oversized DF packets dropped at a bottleneck with missing feedback, that forwarding defect remains meaningful even when a separate checksum warning is an offload artifact.

For classroom analysis, ask students to write three lines: what was observed, what it supports, and what remains unknown. “Repeated large packets leave the sender” is different from “the receiver received them.” An ACK that advances across those bytes is stronger delivery evidence than a retransmission label alone. Use the packet-capture analysis test to practice those limits before building a repair claim around one screenshot.

Complete Course • 180 Teaching Days

Build from encapsulation to verified delivery

Students need transport and routing foundations before nested-tunnel evidence makes sense. The Complete 180-Day Teacher Curriculum provides daily lessons, activities, and simulators for planning that progression and revisiting the gaps practice reveals.

AP Networking Complete 180-Day Teacher Curriculum
$199.99
180 Lessons • 180 Daily Simulators • 36 Teaching Weeks
BUY NOW — INSTANT ACCESS → See 3 free curriculum examples

Match the repair to the protocol and verify the workload

MSS clamping can mitigate some TCP size problems by lowering an advertised receiving limit. Inspect the correct direction, use a fresh connection, and confirm the resulting packets. A rewrite on a server SYN-ACK constrains client-to-server data; it does not directly reduce the server’s download data. Existing connections may have completed setup before the rule existed. Preserve this distinction when a new session passes while an older one behaves differently.

UDP needs separate attention. TCP MSS rewriting does not resize DNS responses, video datagrams, or QUIC packets. The application or transport may need appropriate packetization and path-size discovery. Datagram PLPMTUD, described in RFC 8899, uses probe outcomes to establish usable sizes and recover from a packet black hole. Its availability depends on the implementation; do not assume every UDP application has that behavior.

After a repair, repeat the original large workload with ordinary security checks enabled. Test upload and download, affected address families, required endpoints, and any standby route that forms part of the service requirement. Observe advancing delivery rather than only a completed handshake. Save the before-and-after packet boundary, effective route, feedback result, and exact change. If a conservative local MTU restored service while feedback remains blocked, document both the working mitigation and the remaining defect.

Use your downloaded attempt log to choose the next review task. A wrong subtraction calls for a labeled byte budget; a reversed MSS direction calls for two handshake arrows; a weak diagnosis calls for a controlled evidence comparison. Return to the topic practice library for those specific gaps, or connect the work to the AP Networking study guide. Your log stays local until you choose to share it; this page does not submit it to Canvas or a teacher dashboard.

Technical references and a classroom evidence task

These are original instructional questions, not official Cisco or College Board items. For the protocol rules, consult RFC 1191: IPv4 PMTUD, RFC 8200: IPv6 fragmentation and link requirements, RFC 8201: IPv6 PMTUD, RFC 6691: TCP options and MSS, and RFC 8899: datagram PLPMTUD. Capture caveats are documented in the Wireshark offloading guide; check probe options in the official iputils ping documentation.

For a short written assessment, give a student one working small request, one stalled transfer, and two captures. Require a labeled size calculation, the direction of the failing data, one competing explanation, a narrow next test, and a measurable acceptance condition. Score the connection between evidence and decision, rather than whether the student used the phrase “MTU black hole.”