What Happens When UDP Exceeds MTU?

When a User Datagram Protocol (UDP) datagram exceeds the network’s Maximum Transmission Unit (MTU), the underlying Internet Protocol (IP) layer must either fragment the packet into smaller pieces or drop it entirely. Because UDP is a connectionless protocol without built-in mechanisms for packet retransmission or MTU negotiation, exceeding the MTU often leads to fragmentation overhead, increased packet loss rates, or silent data delivery failures.

IP Fragmentation in IPv4

In standard IPv4 networks, when a UDP packet is larger than the local MTU (typically 1,500 bytes for Ethernet), the sending host or an intermediate router divides the payload across multiple smaller IP packets.

• Fragment Splitting: The original payload is split, and each resulting fragment receives its own IP header. Only the very first fragment contains the original UDP header (which includes source and destination port numbers).
• Reassembly: The destination host collects all fragments based on the IP identification field and reassembles the complete UDP datagram before handing it off to the receiving application.

The “Don’t Fragment” (DF) Flag

If the application or operating system sets the “Don’t Fragment” (DF) bit in the IPv4 header:

1. Packet Dropped: Any router along the path with an MTU smaller than the datagram size cannot fragment the packet and will discard it.
2. ICMP Notification: The router sends back an ICMP Type 3, Code 4 message (“Destination Unreachable, Fragmentation Needed and DF Set”).
3. Application Impact: Because UDP is connectionless, the operating system might not relay this ICMP error to the sending application, causing the application to experience silent data loss unless it actively listens for raw ICMP messages.

Behavior in IPv6

IPv6 eliminates intermediate router fragmentation entirely:

• Intermediate routers never fragment packets. If a UDP datagram exceeds the link MTU, the router drops the packet immediately.
• The router generates an ICMPv6 Type 2 “Packet Too Big” (PTB) error message back to the source.
• In IPv6, fragmentation can only be performed by the sending host using an IPv6 Fragmentation Extension Header if it decides to accommodate smaller MTUs.

Key Risks of Exceeding MTU with UDP

Exceeding the MTU causes several significant performance and operational issues:

• Amplified Packet Loss: If even one fragment of a datagram is lost in transit, the entire UDP datagram cannot be reassembled and is discarded by the destination host. Losing a single fragment causes the entire message to fail.
• Firewall and NAT Filtering: Intermediate firewalls and NAT gateways often drop non-initial fragments because these trailing fragments lack the UDP port information found only in the first fragment.
• Buffer and CPU Overhead: Reassembling fragmented packets requires the receiving host to hold incomplete datagrams in memory, consuming resources and introducing latency.

Best Practices

To prevent issues related to exceeding the MTU:

• Keep Payloads Small: Restrict UDP payload sizes to well below the standard MTU. A safe payload size for the public internet is typically 1,200 to 1,400 bytes (accounting for 20 bytes of IPv4/40 bytes of IPv6 headers and 8 bytes of UDP header). DNS, for example, historically limited UDP payloads to 512 bytes for maximum compatibility.
• Implement Path MTU Discovery (PMTUD): Dynamically detect the smallest MTU on the communication path to size UDP packets appropriately.
• Handle Fragmentation at the Application Layer: If large datasets must be transferred over UDP, split the data within the application layer itself so each independent piece fits inside a single standard packet.