The difference between PING DF and MTU size of the link

The ping command has different implementation based on the operation systems and the networking vendors’ and software’s devices. Most of the time, when the MTU must be tested, the ping command is used with DF (Don’t Fragment) bit set. At the Ethernet header must be added the IP header (20 bytes without Options) and ICMP header (8 bytes); in some cases these values must be subtracted from the link MTU, in some cases even the Ethernet frame header (12 bytes – DMAC, SMAC, Type) and sometimes even the Ethernet CRC. 

Every operating system has its own way to implement the ping command. After all, each networking equipment has an operating system and most of the time the operating system is based on Linux/Unix, you will find the fine print hiding somewhere in the code or on vendors pages, if you search for it.

802.3 Ethernet frame – 1538 bytes

The Ethernet frame, including the ICMP header, has 1538 bytes if we include Preamble, SFD, CRC and IFG.

IEEE 802.3 Ethernet frame - 1538 bytes/octets
Pre SFD	DMAC	SMAC	Type 0x8000	IP 20 bytes	ICMP 8 bytes	Payload / Data		CRC FCS	IFG
8	6	6	2	1500				4	12
	802.3 Ethernet payload - 14 bytes			IP+ICMP payload – 28 bytes

When the ping command with DF (Don’t Fragment bit set) is issue, for 1500 bytes MTU, the following values are the maximum:

1.  Windows – 1472 bytes (the IP+ICMP headers are not included in the MTU value); the command is looking like below:

ping [IP] -l 1472 –f

2.  Linux – 1472 bytes (the IP+ICMP headers are not included in the MTU value); the command is looking like below:

ping -s 1472 -M do [IP]

3. Cisco IOS – 1500 bytes (IP+ICMP headers are included in the MTU value); the command is looking like below:

ping [IP] size 1500 df-bit

4.  Cisco IOS XR – 1500 bytes (IP+ICMP headers are included in the MTU value); the command is looking like below:

ping [IP] size 1500 donnotfrag

5. Cisco NXOS – 1472 bytes (IP+ICMP headers are NOT included in the MTU value); the command is looking like below:

ping [IP] packet-size 1472 df-bit

6. Juniper Junos – 1472 bytes (the IP+ICMP headers are not included in the MTU value); the command is looking like below:

run ping [IP] size 1472 do-not-fragment

7. Huawei VRP – 1472 bytes (the IP+ICMP headers are not included in the MTU value); the command is looking like below:

ping  -s 1472 -f [IP]

I have added below some of the other Ethernet encapsulation, yellow part representing the IP+ICMP header which you must not forget to subtract from the size of the packet from ping command. Cisco is an exception as it adds automatically the IP+ICMP header to the packet size (and even VLAN TAG in 802.1Q). Also Huawei is another exception, the tagged frames, QinQ frames and L2VPN frames do not take into consideration the additional payload of the frames (IP+ICMP must be subtracted), but for L3VPN the additional payload headers and IP+ICMP must be subtracted also. If you want to read some more information about MTU you can check the Almighty-MTU .

802.1Tagged Ethernet frame – 1542 bytes

IEEE 802.1Q - tagged Ethernet frame - 1542 bytes/octets
Pre SFD	DMAC	SMAC	C-TAG 0x8100	Type 0x0800	IP 20 bytes	ICMP 8 bytes	Payload / Data	CRC FCS	IFG
8	6	6	4	2	1500			4	12
	802.3 Ethernet payload - 14 bytes			TAG 4 bytes	IP+ICMP payload –  28 bytes
	802.1Q Ethernet payload - 18 bytes

802.1 AD Double Tagged Ethernet frame – 1546 bytes

IEEE 802.1AD - double tagged Ethernet frame - QinQ - 1546 bytes/octets
Pre SFD	DMAC	SMAC	P-TAG 0x88a8	C-TAG 0x8100	Type 0x0800	IP 20 bytes	ICMP 8 bytes	Payload / Data	CRC FCS	IFG
8	6	6	4	4	2	1500			4	12
	802.3 Ethernet payload - 14 bytes			P-TAG 4 bytes	C-TAG 4 bytes	IP+ICMP payload – 28 bytes
	802.1AD Ethernet payload - 22 bytes

MPLS 802.1 AD Double Tagged Ethernet frame – 1558 bytes

IEEE 802.1AD frame with 3 MPLS Headers - 1558 bytes/octets

Pre SFD

LSP Label

RSVP Label

VPN Label

I-DMAC

I-SMAC

P-TAG 0x88a8

C-TAG 0x8100

Type 0x0800

IP 20 bytes

ICMP 8 bytes

Payload / Data

CRC FCS

IFG

8

4

4

4

6

6

4

4

2

1500

4

12

3 MPLS labels - 12 bytes

802.3 Ethernet payload - 14 bytes

P-TAG 4 bytes

C-TAG 4 bytes

IP+ICMP payload –  28 bytes

802.1AD frame with 3 MPLS Headers - 34 bytes

I feel like this MTU size and ping with different implementation for different vendors and products and software really require a standard else we will face the same mess we have right now. What do you think?

By Mihaela Paraschivu