Ending the "silent drop": how Dynamic Path MTU Discovery makes the Cloudflare One Client more resilient

Cloudflare One Client implements Dynamic Path MTU Discovery (PMTUD), cloudflare One Client performs active PMTUD probing using MASQUE and QUIC.

Dynamic Path MTU Discovery probes network path with encrypted packets of varying sizes probes from upper MTU bound down to midpoint until it identifies the path MTU.

Cloudflare One Client dynamically adjusts virtual interface MTU resizes MTU on the fly and periodically validates path capacity after connection start.

PMTUD Black Hole occurs when ICMP feedback is dropped by network devices firewalls or middleboxes can silently drop ICMP 'Destination Unreachable' messages causing packet loss without feedback.

MASQUE protocol is used by the Cloudflare One Client to perform end-to-end path interrogation, mASQUE runs on top of Cloudflare's open source QUIC library to send encrypted probes to the Cloudflare edge.