nerdexam
Cisco

350-401 · Question #554

Refer to the exhibit. An engineer troubleshoots connectivity issues with an application. Testing is performed from the server gateway, and traffic with the DF bit set is dropped along the path after i

The correct answer is A. PMTUD does not work due to ICMP Packet Too Big messages being dropped by an ACL. The observed issue indicates a failure of Path MTU Discovery (PMTUD), where large packets with the DF bit set are dropped because an intermediate link's MTU is exceeded, and the necessary ICMP 'Packet Too Big' messages are being blocked.

Submitted by viktor_hu· Mar 6, 2026Infrastructure

Question

Refer to the exhibit. An engineer troubleshoots connectivity issues with an application. Testing is performed from the server gateway, and traffic with the DF bit set is dropped along the path after increasing packet size. Removing the DF bit setting at the gateway prevents the packets from being dropped. What is the cause of this issue?

Exhibits

350-401 question #554 exhibit 1
350-401 question #554 exhibit 2

Options

  • APMTUD does not work due to ICMP Packet Too Big messages being dropped by an ACL
  • BThe remote router drops the traffic due to high CPU load
  • CThe server should not set the DF bit in any type of traffic that is sent toward the network
  • DThere is a CoPP policy in place protecting the WAN router CPU from this type of traffic

How the community answered

(25 responses)
  • A
    68% (17)
  • B
    12% (3)
  • C
    4% (1)
  • D
    16% (4)

Why each option

The observed issue indicates a failure of Path MTU Discovery (PMTUD), where large packets with the DF bit set are dropped because an intermediate link's MTU is exceeded, and the necessary ICMP 'Packet Too Big' messages are being blocked.

APMTUD does not work due to ICMP Packet Too Big messages being dropped by an ACLCorrect

When the DF (Don't Fragment) bit is set and a packet exceeds an intermediate link's MTU, the router must drop the packet and send an ICMP 'Packet Too Big' message back to the sender. If these ICMP messages are blocked, for instance by an ACL, the sender cannot learn the correct Path MTU and will continue to send oversized packets that get dropped, indicating PMTUD failure.

BThe remote router drops the traffic due to high CPU load

While high CPU load can cause drops, the specific interaction with the DF bit and packet size, and the resolution by removing the DF bit, strongly points to an MTU/PMTUD issue rather than general CPU overload.

CThe server should not set the DF bit in any type of traffic that is sent toward the network

Setting the DF bit is a common practice for many applications to leverage PMTUD and avoid IP fragmentation, which can degrade performance; the problem lies not in setting the DF bit, but in the failure of PMTUD when it is set.

DThere is a CoPP policy in place protecting the WAN router CPU from this type of traffic

Control Plane Policing (CoPP) protects a router's CPU from excessive traffic destined *to* the router itself (e.g., management or routing protocols) and typically does not drop forwarded data plane traffic based on the DF bit or MTU in this manner.

Concept tested: Path MTU Discovery (PMTUD) failure

Source: https://www.cisco.com/c/en/us/support/docs/ip/generic-routing-encapsulation-gre/25880-pmtud-ipfrag.html

Topics

#DF bit#PMTUD#MTU#Network troubleshooting

Community Discussion

No community discussion yet for this question.

Full 350-401 Practice