ping -M do -s: Diagnose MTU and Path Issues
ping -M do -s <size> sends a fixed-size packet with the Do-Not-Fragment bit set, so it fails loudly when a packet is too big for the path.
A connection that completes the handshake but stalls on the first large response is often an MTU black hole, common over VPNs and overlay networks. This ping variant pinpoints the size where packets start disappearing.
What it does
With -M do, ping sets the IP Do-Not-Fragment flag; with -s it sets the payload size. If a router on the path needs to fragment a packet that large but cannot, it drops it, and ping reports the failure instead of the silent stall a real connection would suffer.
Common usage
# probe a large packet with fragmentation forbidden
ping -c 2 -M do -s 1472 db.internal
# binary-search down until it succeeds to find the path MTU
ping -c 1 -M do -s 1400 db.internalOptions
| Flag | What it does |
|---|---|
| -M do | Set Do-Not-Fragment; fail rather than fragment |
| -s <bytes> | ICMP payload size (add 28 for the IP+ICMP headers) |
| -c <count> | Stop after N packets |
| -M dont | Allow fragmentation (the opposite test) |
In CI
The classic symptom is a request that hangs after the headers: small packets pass, the first full-size data packet is dropped. Payload 1472 plus 28 bytes of headers equals the standard 1500-byte Ethernet MTU; if 1472 fails but 1400 works, an overlay or tunnel has lowered the effective MTU.
Common errors in CI
"ping: local error: message too long, mtu=1450" means the local interface MTU is already below your size; that number is the link MTU. "From <router> icmp_seq=1 Frag needed and DF set (mtu = 1400)" identifies the hop that lowers the MTU, exactly the device causing the black hole.