Summary

  • The 28 October MASQUE working-group draft, revision 02, says its advertised mtu is the largest packet a receiver will reconstruct. It is a receiver limit. A compressed QUIC DATAGRAM must still fit the peer’s frame limit and the current path MTU after HTTP/3, QUIC, UDP and IP overhead.
  • Packets of equal original size may compress differently. Section 5.1.5 warns that one successful PMTU probe cannot certify every packet of that size; a tunnel MTU should account for the least compression available to traffic sharing it, including packets sent uncompressed.

The generous tray and the narrow gate

A proxy can advertise mtu=1500 in the http-datagram-contexts field. The number tells its peer how large a packet it is willing to accept after a negotiated processing context has reconstructed it. That is a useful promise. A receiver with a smaller buffer can set a smaller limit. A sender knows the ceiling before it tries to send traffic through a template or a derived-field operation. The draft makes the capabilities directional: each endpoint advertises what it will receive, and the other endpoint may create only the contexts that advertisement permits.

The July revision already imposed the reconstructed-size ceiling. Revision 02 tightens the explanation around the number. Its definition says the receiver’s mtu is not a measurement of path MTU and gives no guarantee that a QUIC DATAGRAM frame can carry a packet of that size. It also says the sender must obey that limit whether it uses a QUIC DATAGRAM frame, a DATAGRAM Capsule or no processing context at all. The capability does one job: it controls what the receiver agrees to rebuild. It cannot widen the links between the two machines.

That distinction gets lost when compression works well. CONNECT-IP and other HTTP Datagram applications can repeatedly carry headers whose fields barely change. The MASQUE proposal lets endpoints define templates for stable bytes, derive values such as packet length, and offload part of checksum completion. A packet that was too wide in its original form may become narrow enough to fit in a QUIC DATAGRAM frame. The receiver restores the omitted or derived fields before handing the packet to the carried protocol. The saving is real, but it is earned by a particular context and a particular packet.

The path sees the compressed version plus its outer layers. Section 5.1.5 says the resulting QUIC DATAGRAM frame must respect the peer’s frame-size limit. The outer IP packet, including HTTP/3, QUIC, UDP and IP overhead, must fit the current path MTU. These limits apply after compression. A 1500-byte reconstructed packet can pass if its wire form is short enough. Another packet below the same receiver ceiling can fail because it compresses poorly or has no matching context. The line on the receiver’s tray remains 1500; the width of the gate has not changed.

A probe can pass while its peers queue outside

Path MTU discovery tries to learn how large a packet can travel. The new draft points out a trap for compressed tunnels: compression can vary between packets of the same original size, including between PMTU probes and other traffic. A successful probe therefore establishes that that wire packet got through under that context. It does not establish that every original packet of equal size will take the same amount of space. Flows may even share Packetization Layer PMTU state while using different compression contexts, a point the draft links to RFC 8899.

This is where a performance knob becomes an evidence problem. A tunnel operator can show a successful probe and set a larger apparent MTU for applications riding inside. The next flow may contain changing bytes that a static template cannot remove. The first flow’s savings are then silently lent to the second. Revision 02’s operational advice is direct: when choosing a tunnel MTU or reporting PMTU to carried traffic, account for the least compression available to traffic sharing that MTU, including traffic that uses none. The most compressible sample is an advertisement for the template, not a capacity certificate for the tunnel.

The draft does not supply a measured loss rate, a deployed tunnel trace or a benchmark for how often the mismatch occurs. The test that would change the operational judgment is concrete: send two original packets of the same size through contexts with different wire lengths, record each QUIC frame and outer packet length, and compare delivered traffic and Packet Too Big feedback against the active path limit. One packet’s success and the other’s failure would locate the boundary without inventing a universal percentage gain.

The reliable detour has a price

There is an attractive escape hatch: if a datagram is too large for a QUIC DATAGRAM frame, put it into DATAGRAM Capsules that can span multiple transport packets. Section 5.1.5 treats that as a different service, not a bigger path. Where the underlying HTTP Datagram protocol permits capsules, they may carry larger datagrams, but they bring reliable delivery, head-of-line blocking, extra buffering and retransmission. They may also reorder relative to QUIC DATAGRAM frames. An application that expected a datagram path can experience a different delay and ordering profile without changing the original payload size.

Worse, the detour can hide the size limit from the traffic inside the tunnel. The draft points to CONNECT-IP Section 10.1 and CONNECT-UDP Section 6.1, which recommend dropping oversized packets and sending ICMP Packet Too Big feedback instead of quietly switching carriage. The feedback tells the original sender to adjust. A capsule that smuggles the large packet through may keep the session looking healthy while denying the sender the observation that its packet would not fit the datagram path. The receiver’s advertised reconstruction ceiling still applies either way.

The draft’s own mtu=1500 example is a teaching device, not a measurement. The two endpoints in that example advertise different derived-field and checksum capabilities even while showing the same reconstructed-size limit. That asymmetry matters. The endpoint that can rebuild one set of omitted fields may not accept another, and neither side has measured the current route merely by placing a number in an HTTP field. A policy that collapses advertisement, compression result, probe success and path capacity into one green light has skipped four separate checks.

The Datatracker lists revision 02 as an active MASQUE working-group Internet-Draft at I-D Exists. Its new Section 5.1.5 gives a useful instruction before any field trial: keep the receiver’s promise, the compressed wire size and the path’s current limit on separate lines. The proxy can remove bytes from a packet. It cannot remove bytes from a bridge.

Sources