WIUNIX ACADEMY
TCP stalls on Linux: diagnose PMTU black holes and retransmissions
Page 3 of 3. Review the earlier steps and prerequisites before continuing.
YOUR SYSTEM. YOUR STEPS.
Where are you working?
Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.
USE YOUR OWN VALUES
Configure this tutorial
Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.
Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.
Set values for my environment6 editable values
When a diagnostic gives no useful result
Retain the exact error and stay within the selected protocol/scope. These diagnostics do not grant permission to create a tunnel, change host security, capture full traffic or generate a stress workload.
No matching socket
The operation may have finished, used another address/port, IPv6, a proxy or another namespace. Confirm the application’s observed tuple and protocol; do not interpret an empty list as healthy TCP.
ss -4 -t -i -n 'dst 198.51.100.20 and dport = :443'
ip -4 route get '198.51.100.20'Source binding or interface check fails
Use an address actually assigned in this namespace and the observed egress interface. Do not add the documentation address to a live interface or move a route to force this panel to work.
ip -4 address show dev 'eth0'
ip link show dev 'eth0'Capture permission is denied
Confirm the installed executable and existing administrative policy with the host owner. Package presence is not capture authorization; do not set global capabilities or disable MAC enforcement.
command -v tcpdump
tcpdump --versionNo ICMP feedback appears
A quiet capture cannot distinguish no oversized traffic from a wrong vantage point or filtered feedback. Recheck source/interface and the real socket PMTU during the authorized attempt; keep snaplen 68 rather than broadening to payload capture.
ip -4 address show dev 'eth0'
ss -4 -t -i -n 'dst 198.51.100.20 and dport = :443'LET’S BUILD
Verify progress on the same path after the approved fix
These panels changed no persistent network setting, so they need no configuration rollback. Observers stop after their counts/deadlines; interrupt a remaining observer in its own terminal if needed. Active probes may update normal kernel PMTU knowledge, which can affect subsequent observations; record ordering rather than flushing it away.
After a separately approved network change, repeat the same bounded observation with comparable authorized application work and confirm useful forward progress, application success and fresh counters on an identified connection. Reducing retransmissions by stopping all traffic is not recovery. Verify the reverse direction with its owner; successful client-to-server probes do not clear server-to-client bulk traffic.
If the change causes regression, use the owning firewall/network/tunnel workflow to restore the recorded previous configuration and verify management access and application traffic. Keep evidence and the unresolved hypothesis; do not stack more global changes. No commands here establish hands-on coverage of every listed distribution or guarantee that a future route will have the same PMTU.
Authorized client-host terminal in the affected network namespace
date -u +%FT%TZ
ss -4 -t -i -n 'dst 198.51.100.20 and dport = :443'
ip -s link show dev 'eth0'The identified connection makes useful progress and the application’s bounded check succeeds on the intended path; remaining directional or visibility gaps are recorded.
GO TO THE SOURCE
Official references
Each environment states how it was reviewed. A documentation review does not claim a hands-on test of every version.
- IPv4 Path MTU Discovery
- TCP PMTUD failure patterns
- Linux ss socket inspection
- iproute2 TCP_INFO display implementation
- Linux route lookup
- iputils ping and DF probes
- tracepath UDP behavior
- tcpdump capture controls
- libpcap filter offsets
- curl configuration, HEAD and timing
- Linux PMTU and TCP probing settings
- Ubuntu iputils packages
- Debian iproute2 package
- Debian tracepath package
- Arch iputils package contents
- Arch iproute2 package contents
- Red Hat packet-capture guidance
- Manjaro package management
KEEP LEARNING