Microsoft KB Archive/233401

{|
 * width="100%"|

INFO: UDP Datagram Can Be Silently Discarded if Larger than MTU

 * }

Q233401

-

The information in this article applies to:


 * Microsoft Windows NT Server versions 3.5, 3.51, 4.0, 4.0 SP4
 * Microsoft Windows NT Workstation versions 3.5, 3.51, 4.0, 4.0 SP4
 * Microsoft Windows 98
 * Microsoft Windows 95
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Professional

-

SUMMARY
When a UDP datagram is larger than the MTU size of physical media and there is no ARP entry for the host it is sent to, Microsoft Windows TCP/IP implementation keeps only the last fragment of the UDP datagram sent to a given destination while waiting for an ARP reply. The rest of fragments are silently discarded.

For example, when a WinSock application attempts to send a single UDP datagram with 12501 bytes of data, the IP layer performs fragmentation and generates nine IP fragments on an Ethernet. The first eight fragments are discarded and only the last fragment is kept while waiting for an ARP reply. When the first ARP reply is received, only the last fragment is sent.

This behavior is by design and complies to Host Requirement RFC stating that ARP should save at least one packet.

MORE INFORMATION
To avoid the UDP packet drop:

 Send a smaller IP datagram than the MTU size before sending a large UDP datagram. This ensures the ARP cache is "primed" so that all IP fragments can be sent out without waiting for the ARP reply  Increase ARP cache life by adjusting the following registry:

Value: ArpCacheMinReferencedLife

Key: Hkey_Local_Machine\System\CurrentControlSet\Services\

\Tcpip\Parameters 

The default is 600 seconds and it can be increased to FFFFFFFF(Hex) seconds.