INFO: UDP Datagram Can Be Silently Discarded if Larger than MTU

• Microsoft Windows NT, versions 3.5, 3.51, 4.0, 4.0 SP4, 5.0
• Microsoft Windows 98
• Microsoft Windows 95

SUMMARY

When a UDP datagram is larger than the MTU size of physical media and there is no ARP entry for the host it is sent to, Microsoft Windows TCP/IP implementation keeps only the last fragment of the UDP datagram sent to a given destination while waiting for an ARP reply. The rest of fragments are silently discarded.

For example, when a WinSock application attempts to send a single UDP datagram with 12501 bytes of data, the IP layer performs fragmentation and generates nine IP fragments on an Ethernet. The first eight fragments are discarded and only the last fragment is kept while waiting for an ARP reply. When the first ARP reply is received, only the last fragment is sent.

This behavior is by design and complies to Host Requirement RFC stating that ARP should save at least one packet.

MORE INFORMATION

To avoid the UDP packet drop:

1. Send a smaller IP datagram than the MTU size before sending a large UDP datagram. This ensures the ARP cache is "primed" so that all IP fragments can be sent out without waiting for the ARP reply



2. Increase ARP cache life by adjusting the following registry:
   
   

   Value: ArpCacheMinReferencedLife
   
   Key: Hkey_Local_Machine\System\CurrentControlSet\Services\
   \Tcpip\Parameters

REFERENCES

For more information about the ARP cache life, refer to the following
article:

Q166750: ARP Cache Entries May Not Time Out for 10 Minutes

Additional query words: winsock udp sentto drop arp cache

Keywords : kbIP kbWinsock
Version : WINDOWS:95; winnt:3.5,3.51,4.0,4.0 SP4,5.0
Platform : WINDOWS winnt
Issue type : kbinfo