MTU sizes

[duke23315]

Hello there,
I work for a rather large organization and we have a little over 1000 pc's. Now we have just moved most of our sites to a private VPN and we have been havening problems with out MTU sizes. Since all out PC's MTU sizes are the default 1500 bytes when they hit the router they have to be fragmented into 2 packets cause of the VPN overhead. i was wondering if there is any way that we could change the MTU size on all the computers all at once, just not one at a time. I have been looking at a way to deploy a MSI with the correct registry changes, but that also hits a problem. In the registry every interface ID is different. So I don’t think I can make 1 MSI file to cover all the pc's we have.

Anyone got any kind of suggestions for me?

[Paul Adams]

By default the MTU size used by Windows is determined on a per-interface basis using PMTU - i.e. the client attempts to determine the MTU by asking routing devices between itself and the endpoint.

If the router does not return a response then 1500 will most likely be used as a fallback, being the largest Ethernet size (without going into jumbo frames) and probably the value the remote machine responds with.

Can the router not be set to respond to the ICMP queries to allow PMTU discovery?
It would be much easier to set it there, in one place, and have the setup work as it should.

As you have found, because the MTU size could be unique per interface on multi-homed machines, it resides in a location in the registry based on the interface GUIDs - so you cannot use a single registry file to set it globally.


This would need to be scripted, or have a standalone executable to do it.
(An alternative would be to set "EnablePMTUDiscovery" to 0, which forces an MTU of 576 bytes for all non-local traffic, but this would probably be a last resort.)

It is also non-trivial to script, as how can you know which specific interface you wish to modify?
Even the name cannot be used - a dual-port NIC would cause issues, or rolling out a script to hundreds of corporate laptops of different brands and models would make it tricky.


The list of adapters on the system are stored in the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters

There is a key under here for each adapter, named using its GUID.
e.g. On my machine, my 2 adapters are:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{5A26501B-37F9-49A7-BDA3-A03F6BC18C0C}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{E16657D9-AFD9-4F50-B14A-393C259E9521}

(In addition to this there is a static key called "NdisWanIp".)

For each adapter GUID listed, there should be a corresponding entry under this registry location:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
This will most likely be a superset of the keys in the other location, don't expect a 1-1 relationship.

The MTU size is configured per interface using the following key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{GUID}
Name: MTU
Type: REG_DWORD
Value: 88 (decimal) up to [maximum MTU supported by the underlying network]

So, returning to my specific case, my keys would be:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5A26501B-37F9-49A7-BDA3-A03F6BC18C0C}\MTU
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{E16657D9-AFD9-4F50-B14A-393C259E9521}\MTU


You are probably already aware, but to check the maximum MTU size between you and a remote client, use the following command:
ping -f -l x -n 1
Where x is a number you want to test - start at 1400 which should work fine for a VPN, the remote client should reply as normal.
When you enter a value for x which is higher than the MTU for that route, you will get a response of "Packet needs to be fragmented but DF set."

Through trial & error you can find the highest MTU value.

[jonjayal]

This is a useful GUI for tweaking your MTU and othr TCP/IP settings without editing the registry directly

Jon