Lion Cipher Lab
Diagnose a path MTU black hole with ping and tracepath — then fix it without opening ICMP wide
- Foundations
- Intermediate
- ~60 min
- Free · no account required
Why it matters
One of the most common 'hardening' tips you will ever be given is 'block ICMP, it is only ping'. It is wrong in a way that is hard to see: ICMP also carries the message that tells a sender 'that packet is too big for the next link, make it smaller'. Block that and you get a black hole — websites that load their first few lines and then freeze, file transfers and VPNs that connect and then hang, SSH that logs in and then stalls on a big command output — while ping-sized tests look fine. Help desks lose days to it. In this lab you build the broken network yourself, measure exactly how it fails,…
What you'll learn
- what MTU, path MTU and the Don't Fragment (DF) bit are, and how Path MTU Discovery uses ICMP 'fragmentation needed'
- measuring a path MTU by hand with `ping -M do -s` and a binary search, and confirming it with `tracepath`
- building a multi-router lab network from network namespaces and veth pairs inside one privileged container
- recognising the black-hole signature: handshakes and small replies work, large transfers hang with no error
- fixing it narrowly (allow ICMP type 3 code 4) and with TCP MSS clamping, and measuring both
- the honest limits: MSS clamping only helps TCP, and 'block all ICMP' is hardening advice that breaks networks
Steps in this lab
- The idea in plain language: MTU, the DF bit, and the message nobody should block
- Start a throwaway privileged container and install the tools
- Why four namespaces, not three — the narrow link has to be in the middle
- Build the network: four namespaces, three virtual cables, two routers
- Measure the path MTU by hand with ping -M do
- Binary-search the path MTU, then let tracepath confirm it
- Start a web server and a measuring helper (the healthy baseline)
- Create the black hole: the 'block all ICMP' hardening rule
- Fix A (the proper fix): let fragmentation-needed through, and nothing else
- Fix B (the workaround): TCP MSS clamping — and measure it
- The negative you must see: MSS clamping does nothing for UDP
- When to reach for which fix — and why PLPMTUD exists
- Honest limits of this lab