Maximum Segment Size (MSS) value advertised by a Server or a System is the preffered size of the segment that it can receive. For an standard packet this is equivalent to the Maximum Transmission unit (MTU) – 40bytes (standard TCP/IP overhead of 40 bytes [20+20]). This is the value that the server advertises and not what we can transmit.
If the MTU is 1500 bytes then the MSS will be 1460 bytes.
The Maximum Transmission Unit (MTU) can be set/modified in real time on Redhat Enterprise Linux or can be set force the value at boot time.
The MTU in simple terms is the maximum size of a packet that can be sent on a Network Interface card. The default MTU size is 1500 bytes.
Recently we had this problem with this problem with an Exchange 2003 server in the HQ and Outlook Clients in a particular branch office. The Branch office connects into the HQ through a site to site IPSec VPN using Juniper Netscreen SSG20 firewalls on either end of tunnels.
The Problem
The Outlook clients would connect OK but suddenly loose connection to the Exchange server and never connect back. The Outlook Client status will say "Disconnected". The client PCs will however be able to ping the server and network connections look OK. This happened in random times and sometimes when sending large emails.
If you have site to site IPSec VPNs configured between two network with your Juniper Netscreen or SSG firewalls and clients from one network access servers or services from the other network then it is advisable to enable Path MTU Discovery support on the Juniper firewalls.
Juniper Netscreen or SSG firewalls running Screen OS by default disable the Path MTU Discovery support. This means, when an IP Packet with DF bit set ("1") in the ip Header and its size after IPSec Encapsulation is more the MTU of the Juniper VPN Firewall arrives at the VPN Firewall, the firewall will ignore the "DF" bit and simply fragments the packets and forwards it to the appropriate tunnel interface. This can cause serious problems with some applications. A classic example is the Microsoft Applications that rely on NetBIOS over TCP/IP which wouldn't prefer the packets being fragmented (and hence DF set).
Dr.TCP is a simple but powerful utility that can let you fine tune the TCP/IP parameters for your Network Interface Card (NIC). It works on Windows XP, 2003,2000.
Dr.TCP takes the hassle out of editing the Windows Registry and modifying keys to fine tune the TCP/IP Parameters at
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\<AdapterID>]
One of the most important thing that is ignored most of the time while troubleshooting a network problem to a host or a network is checking the MTU related issue. This makes more sense in situations like troubleshooting VPN related issues.
MTUROUTE is a small but smart utility that uses ICMP pings of various sizes in order to determine the MTU values (Maximum Transmission Unit) on the path between itself and the target system. MTUROUTE can operate in normal mode where it sends multiple ICMP packets to each hop on the path to identify the smallest MTU between the host and hop or in a Traceroute mode where it will attempt to determine the lowest MTU between the local host and each hop in the communication.
It is important to note that care has to be taken as it generates muti fold ICMP traffic as it tries to determine the MTU Values.