UDP fragmented packets getting dropped

Gagandeep Singh Bajaj 0

I am running a simple iperf test between 2 Linux VMs (RedHat) sending UDP packets. The MTU size is configured as 1500 (as recommended) on both the machines.

I see when I send packets of length greater than 1472, the receiving side does not get anything.

Anything 1472 or smaller, there is no issue. Looks like any kind of UDP fragmentation is causing packet drops.

FYI. VNET encryption is enabled. Can this be the cause and how can we correct this situation?

'''

./iperf3 --udp --client 172.18.22.89 -l 1473 -n 10000 --bitrate 10
'''

'''
Connecting to host 172.18.22.89, port 5201

[ 5] local 172.18.22.87 port 59846 connected to 172.18.22.89 port 5201

[ ID] Interval Transfer Bitrate Total Datagrams

[ 5] 0.00-1.00 sec 1.44 KBytes 11.8 Kbits/sec 1

[ 5] 1.00-2.00 sec 1.44 KBytes 11.8 Kbits/sec 1

[ 5] 2.00-3.00 sec 1.44 KBytes 11.8 Kbits/sec 1

[ 5] 3.00-4.00 sec 1.44 KBytes 11.8 Kbits/sec 1

[ 5] 4.00-5.00 sec 1.44 KBytes 11.8 Kbits/sec 1

[ 5] 5.00-6.00 sec 1.44 KBytes 11.8 Kbits/sec 1

[ 5] 6.00-7.00 sec 0.00 Bytes 0.00 bits/sec 0

[ 5] 7.00-7.07 sec 1.44 KBytes 166 Kbits/sec 1

[ ID] Interval Transfer Bitrate Jitter Lost/Total Datagrams

[ 5] 0.00-7.07 sec 10.1 KBytes 11.7 Kbits/sec 0.000 ms 0/7 (0%) sender

[ 5] 0.00-7.11 sec 0.00 Bytes 0.00 bits/sec 0.000 ms 0/0 (0%) receive

'''

Silvia Wibowo 3,906 Reputation points Microsoft Employee

2024-09-24T00:21:35.89+00:00

Hi @Gagandeep Singh Bajaj , I understand that you're asking about MSS (Maximum Segment Size) of a UDP packet for an Azure VM with default MTU = 1500 bytes.

UDP has a header of 4 x 2 bytes = 8 bytes. Source: UDP on Wikipedia

IP has a header of 20 bytes. Source: IPv4 on Wikipedia

MTU (Maximum Transfer Unit) = UDP header + IP header + MSS (Maximum Segment Size)

1500 = 8 + 20 + MSS, hence MSS = 1472 as you've observed.

VMs in Azure can support larger MTU than the 1,500-byte default only for traffic that stays within the virtual network. Here's how to modify MTU in Azure VM.

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.
Gagandeep Singh Bajaj 0 Reputation points

2024-09-24T01:51:54.1333333+00:00

Hi @Silvia Wibowo

Thanks for the response. These are regular UDP packets which I am trying to send between 2 VMs within the same VNET. There is no reason for this to be dropped, unless Azure networking stack is dropping it because of fragmentation.

Could the issue be -->

https://github.com/MicrosoftDocs/azure-docs/issues/69477

How can the flag enabled if I do not have a support plan?
Ganesh Patapati 735 Reputation points Microsoft Vendor

2024-09-25T18:13:09.3866667+00:00

Hello Gagandeep Singh Bajaj,

Good day!

Just dropping in to see if you had a chance to read my response to your query about correcting the issue. If you have any further concerns, please do not hesitate to contact us.

We are pleased to help you.

I look forward to your response and appreciate your time on this.

Regards,

Ganesh
Gagandeep Singh Bajaj 0 Reputation points

2024-09-26T02:55:26.1166667+00:00

Thanks.
i debugged it more, and with VNET encryption enabled ... always the 2nd fragment is not reaching the destination machine. It is dropped somewhere by the Azure stack.

You might want to raise an internal bug on Azure networking team to check.
Ganesh Patapati 735 Reputation points Microsoft Vendor

2024-09-26T18:49:52.1266667+00:00

Hello Gagandeep Singh Bajaj,

Greetings!As Silvia Wibowo is mentioned in above comment is correct and whatever the document is sent by us is correct.First let me know how you arrived at 1472 and remaining 28bytes what happened to that in 1500 MTU. If you are using more than that it will definitely break.

Q. Is their data not encrypted?

Ans: Fragmented packets aren't offloaded to hardware and don't get encrypted. Use an MTU of 1500 in the network configuration of your virtual machines.

Refer: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-encryption-faq#is-there-data-not-encrypted

As clearly mentioned in above statement remaining 28 will go as header and net effective MTU will more than 1500 that's why the moment it become 3bytes its not working as expected.

As I recommended to use 1500 MTU when you are enabled Vnet encryption.

Please let me know is your issue is resolved or not.

we are happy to assist you.

Regards,
Ganesh
Gagandeep Singh Bajaj 0 Reputation points

2024-09-27T03:46:36.5266667+00:00

Hi

Thanks for the response.

I am using 1500 bytes as MTU, and that is how i got to packet size of 1472 .

I am not sure what is the recommendation from your side? Is packet drop expected?
Ganesh Patapati 735 Reputation points Microsoft Vendor

2024-09-27T18:19:52.6666667+00:00
Hello Gagandeep Singh Bajaj,

Good day!

from the documentation end the recommended MTU is 1500, I can see you are using 1472 the effective MTU is 1500 and you are not facing any problem when you are using 1472.

Since as per document 1472 is MSS If you increase it, we cannot comment on its behavior when it exceeds it.

If not, you can file a support incident to have this looked into, and an update from support will also be sent out in accordance with the suggested considerations.

Regards,

Ganesh
Gagandeep Singh Bajaj 0 Reputation points

2024-09-27T18:42:37.0833333+00:00

Thanks.

We are raising a support ticket and as you mentioned keeping MTU at 1500 as recommended.
Ganesh Patapati 735 Reputation points Microsoft Vendor

2024-09-27T19:00:19.7833333+00:00
Hello Gagandeep Singh Bajaj,

Greetings,

I've turned my comment into an answer.

So please accept it and give it your best vote so that those in the community who are experiencing similar issues may quickly discover a solution.

We are very grateful for your contribution.

Best wishes,

Ganesh
Ganesh Patapati 735 Reputation points Microsoft Vendor

2024-09-30T09:31:02.45+00:00

Hello Gagandeep Singh Bajaj,

Greetings!

I will initiate a private conversation for the "support request number" where we can also be able to track the support request raised by you, when the issue gets resolved we will update and post it has a public.

I value your time and look forward to hearing from you on this.

Regards,

Ganesh

1 answer

Ganesh Patapati 735 Reputation points Microsoft Vendor

2024-09-24T19:05:40.3133333+00:00
Hello Gagandeep Singh Bajaj,

Good day!

Welcome to the Q&A Platform for Microsoft! We appreciate you posing your query here.

Since both the VM's are in the same VNET you can configure MTU by following the below document here:

Refer: https://learn.microsoft.com/en-us/azure/virtual-network/how-to-virtual-machine-mtu?tabs=windows

Also, read this document explaining why we do not recommend fragmentation.

Refer: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-tcpip-performance-tuning#azure-and-fragmentation

If you want to enable out of order fragmentation, then it can be enabled for some cases as there are limitations in the backend. This will require a support ticket.

If the preceding response helps to solve your concern, please remember to "Accept Answer" and "Upvote it" so that others in the community with similar problems can easily find a solution.

Your contribution is greatly appreciated.

Regards,

Ganesh
Please sign in to rate this answer.
Ganesh Patapati 735 Reputation points Microsoft Vendor

2024-10-01T09:42:42.68+00:00

Hello Gagandeep Singh Bajaj,

Greetings!

I will initiate a private conversation for the "support request number" where we can also be able to track the support request raised by you, when the issue gets resolved we will update and post it has a public.

I value your time and look forward to hearing from you on this.

Regards,

Ganesh
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

UDP fragmented packets getting dropped

1 answer

Your answer