350-401 · Question #554
Refer to the exhibit. An engineer troubleshoots connectivity issues with an application. Testing is performed from the server gateway, and traffic with the DF bit set is dropped along the path after i
The correct answer is A. PMTUD does not work due to ICMP Packet Too Big messages being dropped by an ACL. The observed issue indicates a failure of Path MTU Discovery (PMTUD), where large packets with the DF bit set are dropped because an intermediate link's MTU is exceeded, and the necessary ICMP 'Packet Too Big' messages are being blocked.
Question
Refer to the exhibit. An engineer troubleshoots connectivity issues with an application. Testing is performed from the server gateway, and traffic with the DF bit set is dropped along the path after increasing packet size. Removing the DF bit setting at the gateway prevents the packets from being dropped. What is the cause of this issue?
Exhibits
Options
- APMTUD does not work due to ICMP Packet Too Big messages being dropped by an ACL
- BThe remote router drops the traffic due to high CPU load
- CThe server should not set the DF bit in any type of traffic that is sent toward the network
- DThere is a CoPP policy in place protecting the WAN router CPU from this type of traffic
How the community answered
(25 responses)- A68% (17)
- B12% (3)
- C4% (1)
- D16% (4)
Why each option
The observed issue indicates a failure of Path MTU Discovery (PMTUD), where large packets with the DF bit set are dropped because an intermediate link's MTU is exceeded, and the necessary ICMP 'Packet Too Big' messages are being blocked.
When the DF (Don't Fragment) bit is set and a packet exceeds an intermediate link's MTU, the router must drop the packet and send an ICMP 'Packet Too Big' message back to the sender. If these ICMP messages are blocked, for instance by an ACL, the sender cannot learn the correct Path MTU and will continue to send oversized packets that get dropped, indicating PMTUD failure.
While high CPU load can cause drops, the specific interaction with the DF bit and packet size, and the resolution by removing the DF bit, strongly points to an MTU/PMTUD issue rather than general CPU overload.
Setting the DF bit is a common practice for many applications to leverage PMTUD and avoid IP fragmentation, which can degrade performance; the problem lies not in setting the DF bit, but in the failure of PMTUD when it is set.
Control Plane Policing (CoPP) protects a router's CPU from excessive traffic destined *to* the router itself (e.g., management or routing protocols) and typically does not drop forwarded data plane traffic based on the DF bit or MTU in this manner.
Concept tested: Path MTU Discovery (PMTUD) failure
Source: https://www.cisco.com/c/en/us/support/docs/ip/generic-routing-encapsulation-gre/25880-pmtud-ipfrag.html
Topics
Community Discussion
No community discussion yet for this question.

