Member Avatar for gattaca

We recently installed our building with wireless LAN to provide Internet to our clients and users. For the accesss point (AP) we're using the brand MERU AP100 and the other devices are: PoE switch is MNO M24PWR and Hitachi GS3000 and the AP Controller is Meru 1100 (japan brands I guess).

We can surf the Internet and do online chats except for Hotmail and Yahoo mail messaging. It goes "Page cannot be displayed" after a few minutes of waiting. I read in one of the forums here that I can change the MTU# of my PC and it worked fine after changing to 1358 (using Dr. TCP utility). My worry is, it is not convenient for our clients to do something on their PCs/notebooks and change their MTU# setup.

So here are my questions:

1. What is the default MTU# for Windows XPs, Win2K or Win 98?

2. Which of the devices given above can be setup in such a way that on the users' side, we no longer have to change the MTU#? Instead, change this device's MTU# (is there such?) to match the default MTU# of most PCs.

3. If its either the Controller or the switch, may I have the step-by-step procedure please.

Our vendor/engineers who installed this WLAN doesnt seem to know how to tweak this(I was even the one who told them about this MTU changing). Apparently this is their first venture for a wireless LAN so would really appreciate the BIG help from all of you!

May thanks in advance!

  • 2 Contributors
  • 3 Replies
  • 185 Views
  • 22 Hours Discussion Span
  • Latest Post Latest Post by w1r3sp33d

Dani AI

Generated

This is almost certainly a path‑MTU / MSS problem rather than a Hotmail/Yahoo bug. ’s experiment (changing a client MTU and getting success) is a useful diagnostic, but changing every guest device is not a workable solution for a shared WLAN.

When an intermediate hop can’t forward a large packet the sender should be told to shrink packets via an ICMP “fragmentation needed” message; if those messages are blocked or a tunnel/overhead isn’t accounted for, TCP never reduces its segment size and some HTTPS/logon flows will hang. That is the Path MTU/PLPMTUD behaviour and the classic “PMTU black hole.” (datatracker.ietf.org)

Practical fixes that avoid editing each client:

  • Fix at the network edge (gateway/firewall/NAT): enable TCP MSS clamping or set the WAN/tunnel MTU so clients negotiate a safe segment size automatically.
  • Allow ICMP “fragmentation needed” (type 3, code 4) to pass for destination hosts, or use the device’s MSS‑clamp/tunnel‑MTU features when available.
    Some AP/controllers and routers expose MSS/tunnel MTU options so the AP can clamp MSS for all stations; other vendors put that feature in the edge firewall. Check your controller/router firmware for “MSS clamping”, “tunnel MTU” or “TCP MSS” settings and update firmware if needed. (watchguard.com)

Quick diagnostic and workflow (do these in sequence):

  1. Reproduce the failure from one test client plugged straight to the modem to confirm the router/AP is the culprit.
  2. Run a path‑MTU probe from a client (use the ping DF test) to locate the largest non‑fragmenting payload: 
ping -f -l <size> <destination>

Iterate the size until the probe succeeds; that tells you where to clamp MSS or what MTU to set. (jonmoore.duckdns.org)

If you cannot change the edge device, a single NAT/proxy box that clamps MSS for all guest traffic is an acceptable fallback, but the preferred approach is to correct the edge so all clients work without manual changes. (sec.cloudapps.cisco.com)

Recommended Answers

All 3 Replies

Member Avatar for w1r3sp33d

Default MTU for ethernet is 1500 bytes.

The reason DSL needs the MTU changed to 1492 is so it can rob 8 bits for an ATM header. Some backbone network you are crossing is requiring a smaller MTU, start at 1492 and work your way down until it works, the biggest one that works will provide the best performance.

Ideally you want the router to take care of this (or educate everyone on how to change their MTU, Dr. TCP is the easiest way to do it.)

I do not know if any of those devices can modify your MTU, I am guessing they cannot.

Beware I am a Cisco zealot, but I would go with a Pix 501 to get a good firewall in place as well as modifying the MTU. Oh yeah, fire your curent vendor.

My two cents, whatever it is worth :)

Member Avatar for gattaca

Default MTU for ethernet is 1500 bytes.

The reason DSL needs the MTU changed to 1492 is so it can rob 8 bits for an ATM header. Some backbone network you are crossing is requiring a smaller MTU, start at 1492 and work your way down until it works, the biggest one that works will provide the best performance.

Ideally you want the router to take care of this (or educate everyone on how to change their MTU, Dr. TCP is the easiest way to do it.)

I do not know if any of those devices can modify your MTU, I am guessing they cannot.

Beware I am a Cisco zealot, but I would go with a Pix 501 to get a good firewall in place as well as modifying the MTU. Oh yeah, fire your curent vendor.

My two cents, whatever it is worth :)

Hi and thanks for ur help. Some notes though... mine works after changing MTU to 1358. I`ve tried 1492 but it didnt work. Is it bcuz we`re using wireless and not wired DSL?

If your guess is that the only way to access Hotmail/Yahoo is by changing the MTU from the PC/user side then it will really be a troublesome because our clients come and go. Okay, we are a hotel and we provide this Internet to our guests. And assuming, we tweaked their MTU, do we have to put it back or the new MTU# (1358 in our case) will still work in his/her own network?

I was thinking Yahoo or Hotmail should be the one solving this problem for us. I`ve seen so many threads having this access problem and they dont seem to be bothered. It seems their not adjusting to the way users are accessing their services (i.e., DSL, cable and now the wireless).

Anywayz, I still cross my fingers that there will be a better solution to this. And in case you`ll find it ahead of me :D , please update this thread!

Thanks a lot!

Member Avatar for w1r3sp33d

PC should continue to work when they go back to their other networks. PC utilities will say that their system is not optimized and change it back, some programs will trip an alarm if you script the change, so people may complain about their pc saying that your network is acting "suspicious" or "dangerous" depending on what they are running.

The only other thought I have is drop a pc in with two NIC's and set the outside NIC's MTU to 1358 and set the ip address of the inside NIC to 1500 with internet sharing. If you go this route you will be depending on that pc to proxy all internet traffic, single point of failure less appropriate than a real firewall but probably cheaper if you can do it yourself.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.