1
Diagnostic step 1
Temporarily disable hardware NAT/acceleration in the router and retest large TCP transfers to see if the problem disappears (reversible setting).
FULL AI ANALYSIS
Intermittent IPv4 packet drops after enabling hardware NAT on consumer router
Generated Oct 3, 2026, 12:35:03 AM
Analysis summary
Symptoms point to a Path MTU / MSS-related packet loss or an offload/acceleration bug in the router's hardware NAT implementation. The fact that reducing MSS/MTU on the client restores connectivity suggests in-path fragmentation or TCP MSS clamping is failing. The temporary improvement after reboot suggests stateful hardware resource exhaustion (conntrack/NAT table) or a hardware firmware bug that manifests under sustained flows.
Possible causes
Router hardware NAT (packet offload) mishandles large TCP segments leading to black-holing of packets (PMTU/MSS related).
90%Firewall or QoS acceleration path bypassing software MSS clamping; some packets need MSS clamping but router hardware doesn't do it correctly.
88%Fragmentation handling bug in vendor firmware interacting with PPPoE MTU (1492) resulting in lost ICMP 'fragmentation needed' messages.
85%Conntrack or NAT hardware table exhaustion causing new connections to be dropped while small ICMP or already-established flows succeed.
30%Suggested fixes
2
Diagnostic step 2
On an affected client, reproduce failure while running tcpdump on the client and on the router (if supported) to capture MSS/MTU and ICMP 'fragmentation needed' messages; save captures for analysis.
3
Diagnostic step 3
Enable TCP MSS clamping on the router (or add an MSS clamping rule on a downstream device) so that SYNs advertise a lower MSS (e.g., 1200) and verify if connectivity stabilizes.
4
Diagnostic step 4
Monitor router conntrack and NAT table usage (via the router UI or ssh) during heavy transfers to see if entries grow until failures occur; if table exhaustion is observed, increase limits or reduce timeout values.
5
Diagnostic step 5
Rollback to the previous stable firmware or request a vendor beta if a regression is suspected; keep current configuration backed up before any firmware changes (reversible). If the router is OEM-locked and logs are insufficient, consider replacing with a router that exposes diagnostics (or run a bridging test with an alternative router). Escalate to vendor support with packet captures and timing details if disabling hardware NAT resolves the issue but a firmware fix is required.