The MTU topic seems to be confusing, especially among young network engineers. I’ve decided to into two parts. This article is focused on the layer 2 MTU aspect exclusively. I’ve prepared 3 case scenarios to present how’s switch behaves with different MTU settings.

Packet structure

First of all, before we touch on some case scenarios, let’s take a look at the structure of the ICMP packet. The examined packet is a standard ICMP echo request sent by a Linux machine by using a ping command without additional options.

Now since we know what’s a packet structure and the length of particular parts, we can dive deep into case scenarios.

Case scenarios

The topology for all case scenarios is the same. We’ve two Linux PCs interconnected by the Cisco switch. On each link, we’re capturing packets with Wireshark. The difference between the scenarios lays in the interface MTU configuration on the switch.

Case 1

In this scenario, the Switch is configured with standard – 1500 MTU on both interfaces – Gi0/0 and Gi0/1.

First of all, let’s check the connectivity between PC1 and PC2 with a standard ping.

The connectivity is there, we’ve received a response for each packet. Now let’s take a look at the Wireshark1.

As we can see, there are 10 packets in total: 5 requests and 5 replies. Now let’s take a look at the packet structure.

The packet structure and length are the same, as in the example presented at the beginning of this article.

Now let’s change the ping parameters a bit. Now we will send an ICMP packet with a bigger payload. We will specify the size of 1500 with the -s option. Now the packet structure looks like this.

And here’s the execution output.

As we can see, there is no response to our ICMP echo request packets. Let’s take a look at the Wiresharks.

First we have a packet structure. The whole packet is 1542 bytes long.

Now let’s take a look at the overview of the transmitted packets.

On the Wireshark1 we can see, that 5 ICMP echo request packets were sent by the PC1, now let’s take a look at the Wireshark2.

Surprisingly, there are no packets visible on the second link, which is monitored by Wireshark2.

From these observations, we can conclude, that the Switch is not forwarding our frames. Let’s take a look at the counters of the Gi0/0 interface – the one facing PC1.

Looking at the counters, we can see that on the input, there are 5 packets marked as giants. Giants are packets that exceed the MTU set on an interface. Knowing that we can assume that packets that are larger than L2 MTU are not accepted by the interface. Let’s now check what’s the biggest packet, that is accepted.

After the series of checks, the largest possible packets that are accepted by the switch are 1524 bytes long.

Let’s take a look at the packet structure.

And again, from the Wireshark perspective.

Here’s the overview of captured packets.

As we can see, the request and reply packets are 1524 bytes long, and communication is bidirectional.

Now let’s send 1 byte larger packets and see what’s happening.

We don’t have any response. Let’s take a look at Wireshark.

On Wireshark1 we can only see transmitted packets by PC1. Let’s also take a look at the Wireshark2.

It’s not a surprise, we don’t see any packets here. The switch is not forwarding larger frames than interface MTU + 24 bytes.

Case 2

In this scenario, we will change the MTU on the Gi0/0 interface to 9000. The rest of the topology stays the same.

Let’s verify the configured MTU first.

It’s 9000 as expected. Now we’re ready to issue the ping. We will send packets that are 1524 bytes long.

As we can see, there’s no response. Let’s take a look at the Wiresharks.

We’re seeing the packets transmitted by the PC1 on Wireshark1. How about Wireshark2?

No packets here. So the switch is not forwarding our frames. Let’s check the interface statistics.

We’re not seeing any giants in the statistics of Gi0/0, so the problem is located elsewhere. Let’s check Gi0/1 too.

Here we have the problem. There are 5 giant frames recorded in the statistics. As we’ve seen in the previous case, the giant frames are not forwarded by the interface. In conclusion, the switch is receiving frames on the Gi0/0 interface and forwards it to the Gi0/1, but then they’re too large and in effect, they’re dropped.

Case 3

In the last case, both interfaces on the switch are supporting large MTU – they’re set to 9000.

First, let’s check the settings.

As we can see, the 9000 MTU is configured on Gi0/0 and Gi0/1. Let’s now try a ping that’s 1542 bytes long.

We’re getting the response, so the switch is forwarding our traffic. Here’s the output from the Wireshark1.

As we can see, complete communication is visible. There are 10 packets, 5 requests, and 5 responses.