MTU Packet counter increases during packet capture

Showing results for 
Show  only  | Search instead for 
Did you mean: 

MTU Packet counter increases during packet capture

L2 Linker



Doing some analysis and whilst doing a packet capture I notice that flow_fwd_mtu_exceeded  starts increasing rapidly.


Any ideas?




show counter global filter packet-filter yes


flow_fwd_l3_ttl_zero                   15996        0 drop      flow      forward   Packets dropped: IP TTL reaches zero
flow_fwd_l3_noarp                     879583        0 drop      flow      forward   Packets dropped: no ARP
flow_fwd_zonechange                     3213        0 drop      flow      forward   Packets dropped: forwarded to different zone
flow_fwd_mtu_exceeded                 677903     1139 info      flow      forward   Packets lengths exceeded MTU
flow_parse_unmatched_icmperr            3882        0 info      flow      parse     Packets dropped: Unmatched ICMP error message
flow_dos_pf_ipspoof                      669        0 drop      flow      dos       Packets dropped: Zone protection option 'discard-ip-spoof'


Cyber Elite
Cyber Elite

the packets you're receiving are larger than the MTU on your egress interface (and likely have the DF bit set)



do both your interfaces have the same MTU set? is there a DF visible in your captures?

you may need to set TCP MSS on the egress interface to lower the mtu of your overall communication



Tom Piens
PANgurus - (co)managed services and consultancy

Thanks Reaper


I only notice this counter incrementing (quickly) when doing a Packet Capture on Palo. Normal operation I dont see this counter increase.




I dug a little deeper


this means your packets passing through the dataplane are actually larger, but the "mtu' for packetcapture (lives on the management plane) is 1500 so you get this message

packets are not actually discarded, just processed so the pcaps can be collected

Tom Piens
PANgurus - (co)managed services and consultancy
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!