🛡️Cloudflare Blog•Mar 5, 2026Stalecollected in 82m

Dynamic Path MTU Ends Silent Drops

#mtu-discovery#network-resilience#sasecloudflare-one-clientcloudflarecloudflare-one-client

💡Ends MTU silent drops for resilient Cloudflare tunnels—key for reliable AI infra access

⚡ 30-Second TL;DR

What Changed

Adds active probing for optimal packet sizes

Why It Matters

Improves reliability of secure tunnels, vital for enterprise remote access to AI services and apps. Reduces connectivity issues in complex networks.

What To Do Next

Enable Dynamic Path MTU Discovery in Cloudflare One Client settings for stable tunnels to your AI endpoints.

Who should care:Enterprise & Security Teams

Background and context from public sources — not the original article. 10 sources cited.

•PMTUD requires WARP to use the MASQUE tunnel protocol and is disabled by default, enabled via MDM configuration with 'enable_pmtud' set to true.[1]
•Enabling PMTUD generates approximately 25 MB/day of additional probe traffic from the device.[1]
•PMTUD mandates a minimum network path MTU of 1281 bytes, comprising 1200 bytes QUIC datagram, 53 bytes WARP MASQUE encapsulation, and 28 bytes IP/UDP headers.[1]
•PMTUD status can be verified using the 'warp-diag connectivity.txt' command, which displays 'PMTUD enabled: true' and the detected MTU value.[1]

•WARP actively probes the full network path to the minimum MTU using MASQUE protocol, then dynamically adjusts the tunnel interface MTU accordingly.[1]
•Minimum path MTU requirement: 1281 bytes (1200 bytes QUIC datagram + 53 bytes MASQUE encapsulation + 28 bytes IP/UDP headers).[1]
•Enabled via MDM JSON configuration: {"enable_pmtud": true}, which also enforces MASQUE tunnel protocol.[1]
•Verification command: 'warp-diag connectivity.txt', searches for 'PMTU' to confirm status and detected MTU (e.g., 1500 bytes).[1]
•Cloudflare's earlier server-side solution involved open-sourcing 'pmtud' daemon on GitHub, which captures and broadcasts ICMP type 3 code 4 (IPv4) or type 2 code 0 (IPv6) messages to all servers via Ethernet broadcast.[2][6]

WARP clients on low-MTU networks (<1500 bytes) will achieve over 20% higher throughput post-PMTUD enablement

Dynamic MTU adjustment prevents fragmentation and silent drops, optimizing packet sizes for each path as per probe results.[1]

Increased adoption of MASQUE protocol in Zero Trust clients due to PMTUD dependency

PMTUD prerequisite enforces MASQUE, accelerating its use over legacy tunnels for better QUIC-based performance.[1]

2015-12

Cloudflare open-sources pmtud daemon to broadcast ICMP MTU messages, addressing server-side Path MTU Discovery failures.

2024-10

WARP client changelog introduces Path MTU Discovery (PMTUD) as opt-in feature for dynamic MTU adjustment.

2026-03

Cloudflare One Client (WARP) deploys Dynamic Path MTU Discovery in production, eliminating silent drops.

Factual claims are grounded in the sources below. Forward-looking analysis is AI-generated interpretation.

Weekly AI Recap

Read this week's curated digest of top AI events →

Same topic

Explore #mtu-discovery

Same product