Tobias Fiebig traced a slow download to a virtual NIC

Summary

Tobias Fiebig’s RIPE 93 case looked like access-network throttling. Opening the server firewall for ICMP did not cure it; a packet trace and comparison of two virtual machines exposed different emulated network cards.
The affected RTL8139 path held TCP offload to a static 1,500-byte MTU. The route had learned 1,420; locking a more-specific route to 1,320 restored the transfer.

Analysis

The first suspect had an ISP’s name. The packet capture pointed somewhere more embarrassing: a virtual network card that had been in QEMU for years and was still carrying traffic as if every path could accept 1,500 bytes.

At RIPE 93, Tobias Fiebig described a bulk transfer that crawled for clients on a smaller-MTU path but worked from another nearby virtual machine. The obvious theory was that the access network or a firewall was suppressing traffic. The server firewall was changed to allow the relevant ICMP “packet too big” signal. The download stayed slow. A firewall rule had been fixed; the fault had not.

Fiebig checked the route from the affected client. The operating system had learned a path MTU of 1,420 bytes. That should have been enough evidence for the sender to stop emitting packets too large for the path. Instead, TCP retransmissions continued. A more-specific route with a locked MTU of 1,320 made the transfer work. That number was a successful workaround, not the path’s measured MTU: the route lookup had returned 1,420.

The decisive comparison came from trying to reproduce the incident. Fiebig built another virtual machine with the same software and sent the same test packet. Nothing broke. The machines looked alike until he checked the virtual hardware: the affected guest used an emulated Realtek RTL8139; the test guest did not. Identical software had been a poor reproduction because the interface was part of the fault.

Fiebig traced the behavior to QEMU’s net/hw/8139.c: a fixed 1,500-byte MTU in the TCP offload path. The official QEMU issue describes the same failure pattern: low throughput for clients behind links below 1,500 MTU, PMTUD ignored, retransmissions, and a lower guest MTU as mitigation. His talk dates the assumption in the code to 2006 and points to an earlier discussion and patch proposal from 2016. In the reported case, disabling TCP offload was another possible workaround; replacing the old virtual card with VirtIO removed the problem.

Path MTU Discovery is meant to let endpoints adapt to the narrowest link. RFC 1191 describes the IPv4 mechanism; RFC 2923 records how missing or mishandled feedback can turn it into a TCP black hole. That made the firewall suspicion plausible. But once the ICMP rule changed and the transfer did not, the remaining evidence sat at the guest’s offload boundary.

The useful debugging sequence was not “allow more ICMP and hope.” It was to capture the packets, check the MTU the route had learned, compare the virtual adapter model, and then test a narrow workaround. The missing public record is the affected guest’s exact QEMU build and offload configuration; those details would show how far this specific failure generalizes.