Repository navigation
MTU Testing
This page records MTU validation for MASQUE CONNECT-IP connections across
tested client platforms and network types.
The goal is to identify a conservative operational TUN MTU for MASQUE VPN clients while documenting the limits of the tested paths.
Important
These results are measurements from specific devices, networks, carriers, server paths, and test dates. They are not a universal PMTU guarantee. Network conditions, providers, routing, client versions, and protocol implementations can change over time.
Use MTU 1369 as the preliminary default for future MASQUE VPN client releases.
This is an interim operational recommendation, not a protocol requirement and not a guarantee that MTU 1369 will work on every network.
- Linux and Android Wi-Fi testing passed with MTU 1400.
- Android mobile-data testing on Beeline passed with MTU 1400.
- Windows Wi-Fi testing passed with MTU 1400.
- The lowest successful tested path was Android mobile data on MTS: MTU 1370 passed, while MTU 1380 had 100% DF-probe loss.
- MTU 1369 preserves a one-byte margin below that lowest observed successful boundary.
Version v1.5.1 ships with TUN MTU 1369 as the client default. Re-evaluate
this value after testing more carriers, network types, IPv6 paths, devices,
server locations, or PMTU-handling changes.
| Field | Meaning |
|---|---|
| Largest DF-safe MTU | Highest tested interface MTU for which the DF/no-fragment probe succeeded |
| Connect | The tunnel connection was established successfully |
| Ping | A baseline ICMP test completed without observed packet loss |
| DF probe | A no-fragment probe was sent to detect possible PMTU or fragmentation problems |
| HTTP/Curl | An HTTP download completed successfully |
| DF failure | A potential PMTU or fragmentation risk, even if an HTTP download succeeds |
A successful HTTP download does not override a failed DF probe. A failed DF probe is recorded because it may indicate that some traffic patterns could experience fragmentation, black-holing, retransmissions, or reduced reliability.
| Status | Date | Client | Network | Carrier / ISP | Tested MTU range | Largest DF-safe MTU | Candidate MTU | Result |
|---|---|---|---|---|---|---|---|---|
| Done | 2026-08-31 | Linux | Current test network | Not recorded | 1280–1500 | 1400 | 1400 | DF loss begins at 1420 |
| Done | 2026-08-31 | Android | Wi-Fi | Not recorded | 1280–1500 | 1400 | 1400 | DF probe passes through 1400; 100% loss at 1420 and above |
| Done | 2026-08-31 | Android | Mobile data | MTS | 1280–1500 | 1370 | 1369 | MTU 1370 passes; 1380 and above have 100% DF-probe loss |
| Done | 2026-08-31 | Android | Mobile data | Beeline | At least 1400 | 1400 | 1400 | MTU 1400 tested successfully; detailed measurements not recorded |
| Done | 2026-08-31 | Windows | Wi-Fi | Not recorded | 1280–1500 | 1400 | 1400 | DF probe passes through 1400; 100% loss at 1420 and above |
The Android-over-MTS path is currently the lowest successful path recorded:
| MTU | Baseline ping loss | Baseline RTT avg | DF-probe loss | DF-probe RTT avg | Result | Notes |
|---|---|---|---|---|---|---|
| 1280 | 0% | 131.0 ms | 0% | 140.7 ms | Pass | |
| 1300 | 0% | 128.6 ms | 0% | 118.3 ms | Pass | |
| 1350 | 0% | 118.0 ms | 0% | 148.5 ms | Pass | Source screenshot labels this row 1350 m0b; treated as MTU 1350 |
| 1370 | 0% | 127.1 ms | 0% | 118.2 ms | Pass | Largest successful tested MTU |
| 1380 | Not recorded | Not recorded | 100% | — | Fail | Tested separately; DF probe has 100% loss |
| 1400 | 0% | 99.7 ms | 100% | — | Fail | DF probe lost |
| 1420 | 0% | 129.8 ms | 100% | — | Fail | DF probe lost |
| 1450 | 0% | 121.8 ms | 100% | — | Fail | DF probe lost |
| 1472 | 0% | 121.0 ms | 100% | — | Fail | DF probe lost |
| 1500 | 0% | 121.0 ms | 100% | — | Fail | DF probe lost |
Preliminary conclusion: MTU 1370 is the largest successful tested value on this Android/MTS mobile-data path. MTU 1380 has 100% DF-probe loss. MTU 1369 is therefore used as the conservative interim default.
| MTU | Connect | Connect time | Ping | Ping average | DF probe | DF payload | HTTP status | Download speed | Download time | Notes |
|---|---|---|---|---|---|---|---|---|---|---|
| 1280 | Pass | 1.01 s | Pass | 27.291 ms | Pass | 1252 | 200 | 2,010,869 B/s | 5.215 s | |
| 1300 | Pass | 1.02 s | Pass | 33.897 ms | Pass | 1272 | 200 | 2,237,110 B/s | 4.687 s | |
| 1350 | Pass | 1.01 s | Pass | 38.398 ms | Pass | 1322 | 200 | 1,589,259 B/s | 6.598 s | |
| 1380 | Pass | 1.01 s | Pass | 35.568 ms | Pass | 1352 | 200 | 1,753,431 B/s | 5.979 s | |
| 1400 | Pass | 1.01 s | Pass | 36.371 ms | Pass | 1372 | 200 | 1,485,436 B/s | 7.059 s | Largest DF-safe tested MTU |
| 1420 | Pass | 1.01 s | Pass | 31.849 ms | Fail | 1392 | 200 | 1,925,769 B/s | 5.445 s | DF loss |
| 1450 | Pass | 1.01 s | Pass | 36.406 ms | Fail | 1422 | 200 | 1,711,902 B/s | 6.125 s | DF loss |
| 1472 | Pass | 1.01 s | Pass | 24.639 ms | Fail | 1444 | 200 | 2,165,884 B/s | 4.841 s | DF loss |
| 1500 | Pass | 1.02 s | Pass | 30.960 ms | Fail | 1472 | 200 | 2,676,191 B/s | 3.918 s | DF loss |
Preliminary result: MTU 1400 is the largest tested value for which the Linux DF probe succeeds. DF loss begins at MTU 1420.
Test date: 2026-08-31.
| MTU | Baseline ping loss | Baseline RTT avg | DF-probe loss | DF-probe RTT avg | Result | Notes |
|---|---|---|---|---|---|---|
| 1280 | 0% | 66.1 ms | 0% | 139.4 ms | Pass | |
| 1300 | 0% | 115.1 ms | 0% | 78.4 ms | Pass | |
| 1350 | 0% | 138.4 ms | 0% | 94.3 ms | Pass | |
| 1400 | 0% | 135.1 ms | 0% | 110.6 ms | Pass | Largest DF-safe tested MTU |
| 1420 | 0% | 99.1 ms | 100% | — | Fail | DF probe lost |
| 1450 | 0% | 91.9 ms | 100% | — | Fail | DF probe lost |
| 1472 | 0% | 81.8 ms | 100% | — | Fail | DF probe lost |
| 1500 | 0% | 67.1 ms | 100% | — | Fail | DF probe lost |
Preliminary result: MTU 1400 is the largest tested value for which the Android Wi-Fi DF probe succeeds.
Test date: 2026-08-31.
| MTU | DF-probe result | Notes |
|---|---|---|
| 1400 | Pass | Tested successfully; detailed measurements were not recorded in this document |
Preliminary result: MTU 1400 was tested successfully on Beeline mobile data. The MTS path remains the conservative baseline because it has the lower observed maximum.
Test date: 2026-08-31.
| MTU | DF-probe loss | RTT min | RTT avg | RTT max | Result | Notes |
|---|---|---|---|---|---|---|
| 1280 | 0% | 56 ms | 57 ms | 59 ms | Pass | |
| 1300 | 0% | 57 ms | 59 ms | 62 ms | Pass | RTT avg/max corrected from the original transcription |
| 1350 | 0% | 56 ms | 59 ms | 62 ms | Pass | |
| 1400 | 0% | 58 ms | 60 ms | 62 ms | Pass | Largest DF-safe tested MTU |
| 1420 | 100% | — | — | — | Fail | DF probe lost |
| 1450 | 100% | — | — | — | Fail | DF probe lost |
| 1472 | 100% | — | — | — | Fail | DF probe lost |
| 1500 | 100% | — | — | — | Fail | DF probe lost |
Preliminary result: MTU 1400 is the largest tested value for which the Windows Wi-Fi DF probe succeeds. MTU 1420 and above have 100% DF-probe loss.
The current data set does not yet establish a universal safe MTU.
Important gaps include:
- More mobile carriers and countries.
- Ethernet, additional Wi-Fi networks, and captive-portal environments.
- IPv4-only, IPv6-only, and dual-stack paths.
- More Android devices and OS versions.
- More Windows versions and hardware/network adapters.
- More VPS providers, regions, and server-side network paths.
- Repeat runs at different times and under different network load.
- Explicit PMTU and ICMP behavior analysis.
- Measurements after changes to client, server, QUIC, or tunnel MTU handling.
Treat 1369 as a conservative release default that should be revisited as the test matrix grows.
Copy this template for every completed test:
<platform> — <network> — <date>
Client version / commit:
Server version / commit:
Device and OS:
Network:
Carrier / ISP:
IP stack:
Server:
MTU range and step:
Largest DF-safe MTU:
Candidate operational MTU:
Test method:
Raw data:
Notes:
Record the following result table with each run:
| MTU | Connect | Ping | DF probe | HTTP/Curl | Notes |
|---|---|---|---|---|---|
<mtu> |
<Pass/Fail> |
<Pass/Fail> |
<Pass/Fail> |
<Pass/Fail> |
<details> |
Store scripts, raw output, screenshots, and CSV files in the repository where possible. The versioned benchmarks directory should remain the source of truth for raw and release-specific artifacts.
| Date | Decision | Rationale | Scope |
|---|---|---|---|
| 2026-08-31 | Use 1400 as the Linux baseline candidate | Largest tested MTU without DF-probe loss | Linux client to tested MASQUE-server path |
| 2026-08-31 | Record Android Wi-Fi candidate MTU as 1400 | Largest tested MTU without DF-probe loss; MTU 1420 fails | Android client over tested Wi-Fi path |
| 2026-08-31 | Record Android MTS maximum as 1370 | MTU 1370 passes; MTU 1380 has 100% DF-probe loss | Android client over tested MTS mobile-data path |
| 2026-08-31 | Record Android Beeline MTU 1400 as passing | MTU 1400 tested successfully | Android client over tested Beeline mobile-data path |
| 2026-08-31 | Record Windows Wi-Fi candidate MTU as 1400 | Largest tested MTU without DF-probe loss; MTU 1420 and above have 100% loss | Windows client over tested Wi-Fi path |
| 2026-08-31 | Recommend MTU 1369 as interim release default | One-byte margin below the lowest successful observed mobile-path boundary | Future MASQUE VPN client releases pending further validation |
- Getting Started — deployment prerequisites and release guidance.
-
Architecture — QUIC, HTTP/3,
CONNECT-IP, and tunnel flow. - Troubleshooting — diagnosis of unstable or failing connections.
- FAQ — concise answers about UDP reachability and project limits.
- Benchmarks in the repository — versioned test artifacts and raw data.