FULL AI ANALYSIS

HTTP/HTTPS downloads stall ~65s over site-to-site GRE tunnel — TCP handshake OK then throughput drops to zero

Generated Oct 12, 2026, 10:57:59 PM

Analysis summary

Behavior matches a PMTU/MSS black‑hole: TCP connections establish and transfer until a packet larger than an intermediate MTU must be sent with DF set; if an intermediate hop drops those large packets and does not send ICMP fragmentation‑needed back to the sender (or those ICMPs are dropped on path), the sender never learns to reduce MSS and the flow stalls. The fact that lowering tunnel MTU or enabling TCP MSS clamping (which caps MSS to effective PMTU) fixes the issue points to either: (a) a mismatched MTU/overhead calculation on the GRE endpoints vs intermediate hop limits, (b) an ISP or WAN middlebox dropping ICMP type 3 code 4, or (c) NAT/conntrack hardware that mishandles DF/fragmentation. TCP offloads can exacerbate timing but are less likely the primary cause here.

Possible causes

Intermediate WAN/ISP device is dropping packets larger than a given MTU and suppressing/silently dropping ICMP 'fragmentation needed' responses (PMTU black hole).

95%

WAN firewall or NAT device erroneously strips or blocks ICMP type 3 code 4 making PMTU discovery fail.

90%

GRE tunnel MTU set too high relative to actual path MTU (off-by-overhead or additional encapsulation upstream).

85%

Hardware NAT/accelerator on ISP or on-site device mishandles packets with DF set or drops fragments created by lower MTU encapsulation.

50%

Suggested fixes

Diagnostic step 1

Reproduce with controlled tests: run tracepath (or ping -M do -s) from both GRE endpoints and capture on both endpoints for a failing transfer to confirm missing ICMP fragmentation-needed messages. Keep capture window focused to avoid PII.

Diagnostic step 2

Apply reversible mitigation: enable TCP MSS clamping on the GRE egress at both routers (iptables/ebtables rule: --clamp-mss-to-pmtu) and verify large transfers succeed; this avoids touching client stacks and is quickly reversible.

Diagnostic step 3

Temporarily lower the GRE interface MTU (e.g., to 1400) on both endpoints during business hours to confirm behavior change; document and revert if not acceptable for performance.

Diagnostic step 4

Enable kernel tcp_mtu_probing=1 on routers as a diagnostic step to force path MTU probing on affected flows; monitor effects before and after and revert if no benefit.

Diagnostic step 5

If MSS clamping/MTU lowering fixes it, schedule configuration change to make MSS clamp permanent and monitor for regressions; record changes in change control with rollback plan. Do not remove DF handling on servers or disable fragmentation enforcement globally. Keep backups of current router configs prior to changes.

Contact • Help • API Docs • Careers • Terms • Privacy • Cookies • Ads