Diagnose mesh MTU and fragmented traffic
Find packet-size failures across encapsulated workload paths without changing application policy.
An MTU mismatch can allow small packets while larger workload transfers fail. Diagnosis must follow the complete path, including guest interfaces, mesh transport, gateways, and any external tunnel.
Recognize the failure pattern
Compare a small connection test with a request that transfers a larger response. A working TCP handshake followed by stalled data can indicate a path-size issue, but it can also result from application or firewall behavior. Check counters and the actual route before changing MTU.
Test same-node and cross-node traffic separately. A failure only across nodes points toward the transport path. A failure only across an external gateway requires inspecting that gateway and its additional encapsulation.
Establish the path budget
Read the configured guest-facing MTU and transport overhead from Region → Mesh. Compare them with the smallest underlay segment on the selected route. A larger MTU on the source interface cannot compensate for a smaller link later in the path.
Nested tunnels consume additional room. Keep the result tied to the actual route; a test to the agent's management address can bypass the workload tunnel entirely.
Probe without hiding the symptom
Use the host and guest diagnostic tools appropriate to the address family and operating system. Test increasing packet sizes while preventing fragmentation where the protocol supports that method. Record endpoints, direction, packet size, and the observed failure.
Do not change firewall policy to permit arbitrary traffic just to make a probe succeed. Required path-MTU control messages must be permitted through the supported baseline. IPv6 control behavior needs its own review rather than a copy of an IPv4 rule.
Apply a correction
Open Fleet → Region → Networking and submit the reviewed mesh MTU change through a maintenance plan. Verify the applied revision at nodes under Region → Mesh and the resulting guest configuration. Unsupported images can retain their previous local value until explicitly updated.
A regional transport change can affect every workload. Use a canary node set and preserve a management path outside the mesh. Existing connections can need to reconnect after the path changes.
Validate representative traffic
Test both directions, large application responses, backend health probes, storage traffic where it shares the transport, and migration transfers. A successful single packet size is not evidence that every gateway path has the same budget.
Retain the old and new configuration revision and test endpoints in the operation record. See mesh networking, IPv6, and migration transfer controls.