MSS Initiative

How To Check If A Site Is Broken

In an effort to make it easier for people to report broken sites, we are providing instructions on how to check if a site is broken. Checking is not an easy thing to do, nor is it an easy thing to explain, but we will do the best we can.

Please realize that if you only have one box connected to your Broadband connection, the problem is not a PMTUD Blackhole. You may still find these instructions helpful in tracking down what the problem is, but it's not a PMTUD Blackhole. Please also note that if you don't have access to your gateway (login/root), these instructions will be of little help to you.

What You Need

A gateway that has a packet sniffer. This is likely tcpdump if you're using linux or a BSD. If you are using Solaris, this is snoop.
At least one machine behind your gateway. This should be the machine that has problems getting to websites, etc.

What To Do

Start by logging into your gateway, and then become the root user (via su - [unless you want to use sudo]). Then, if you're not already, get familiar with your packet sniffer. You want to be able to tell it to sniff on your external (facing the internet) interface and display only the packets you want. You also want to make it display all the information you need about each packet. Information you'll want to see includes source and destination, packet size, and offset if the packet is fragmented. For example, if you're in Solaris and want to check to see if www.example.com was broken, you would do:

# snoop -d sppp0 -V 192.0.34.72 port 80

# tcpdump -i ppp0 host 192.0.34.72 port 80

Where sppp0 or ppp0 is your external interface, and 192.0.34.72 is the IP for example.com.

It may be advisable to have your sniffer output to a file for later inspection (-w file for tcpdump and -o file for snoop). Once you're comfortable, get the workstation ready. You may want to open up your web browser before you start sniffing to avoid seeing the traffic to whatever the default page is. When you're ready, start sniffing on the gateway, and then on the workstation go to the website (or anything else) you suspect is broken. Watch the packets fly by. Very shortly they should come to a stop. Here's some things you might see and what they mean:

Case 1: The last packet that was from the server to your box was fragmented and had an offset of 0. No more packets came after this. This means that fragmentation is occurring, but *your* firewall is not letting fragments in. This is not a PMTUD Blackhole. This means the website has PMTUD disabled.
Case 2: You see packets exchanged, all of which are well below 1492 bytes in size. Then they stop. The workstation web browser (or mail reader, or...) is just hanging in wait. This might be a blackhole. Skip on down to the next section.
Case 3: You're seeing plenty of packets coming in at a size of 1492. Sorry, I have no idea what's wrong with this site and/or your connection.

If you were Case 2 above, you'll know want to try the experiment again, except displaying more information. We don't have you do this in the original step because having too much information about each packet on your screen can make it nearly impossible to read. This time around you will want to tell your packet sniffer to display the TCP flags. With either snoop or tcpdump, you want the -v switch to make it do this. If you see the same thing as you did last time, AND the "Don't Fragment" (DF) bit is set, then the problem is most likely a PMTUD Blackhole.

Keep in mind you can always use sites listed on the main page as examples to see what broken sites look like. Also keep in mind that occasionally a site will be broken from one place but not another (in this case it's not the firewall directly in front of the webserver but instead a router somewhere on the path between your network and the server).

We hope this page has been helpful. If you are confused by something, let us know.