To Whom it May Concern: As a frequent visitor of www.example.com, I am writing to tell you that your site is not reachable from all locations. This is due to what is called the Path MTU Discovery Blackhole (RFC 2923 - ftp://ftp.isi.edu/in-notes/rfc2923.txt). Essentially what is happening is that your site has Path MTU Discovery (PMTUD) enabled, but is not receiving the ICMP messages that are required for PMTUD to function properly. This is most likely due to ICMP filtering at your site, but may be due to a router in between. One example of this occurrence is users of DSL that use PPPoE. Such customers have links with an MTU of 1492, but machines behind that link that are connected via ethernet have an MTU of 1500. A connection between such a client and your webserver will start off transferring at 1460 (1500-40 headers) since neither side knows about the PPPoE. But the first time your webserver sends a full size packet (which will have the "Don't Fragment" bit set as is required in PMTUD), it won't fit through the PPPoE pipe. At that point the router on the ISP's side of the PPPoE tunnel will send an ICMP type 3 code 4 saying "Fragmentation is needed, but you have the Don't Fragment bit set, please send smaller packets." However, your webserver is not getting this packet. This is most likely being dropped by one of your firewalls, although it is possible a router in front of you, such as your provider, is actually dropping them. There are two solutions to this problem: A) Allow ICMP type 3 code 4 messages to reach the webserver B) Turn off Path MTU Discovery on the web server Solution A enables your webserver to use the right MSS, and does not pose a security threat, see http://www.giac.org/certified_professionals/practicals/gsec/0719.php Solution B will allow the ISP router to fragment the packets. Solution A is highly preferred as fragmentation will lead to poorer performance. For more information, and an explanation of terms and abbreviations read: ftp://ftp.isi.edu/in-notes/rfc2923.txt http://www.phildev.net/mss/ Thank you, Phil Dibowitz Richard van den Berg [email protected]