Forum Discussion

Kazeem_Yusuf's avatar
Kazeem_Yusuf
Icon for Nimbostratus rankNimbostratus
Jul 14, 2026

An Irule that Stops TLS (tcp) Fragmentation on Client Side

There is a requirement to implement a service that extracts Inserted traffic in extension header from subscribers.  the insertion is done by PGW on packet core, and works on server side, which can successfully extract the information from the extension header. When the PGW Succesfully inserts the added extension, the solution on serverside works well.

 

The challenge is that the PGW frequently truncates the TLS Header (TCP), and the serverside (F5), is unable to see the added extension header, since it has been cut off.    A technical explanation is goes thus. 

 "The EPG is configured for Heuristic TLS Enrichment, its Deep Packet Inspection (DPI) engine scans incoming TCP payloads on port 443. The EPG searches for the TLS ClientHello record header. It calculates the extension array offsets, dynamically shifts the remaining TLS bytes downstream, and injects Extension 17516 contains 4 bytes of TLS headers and 16 bytes of data). EPG platforms enforce strict MTU boundaries. If a subscriber's initial ClientHello packet is already 1,445 bytes, adding the 20-byte extension pushes it to 1,465 bytes. The EPG's internal network stack will instantly transmit the first 1,460 bytes and create a second TCP fragment for the remaining 5 bytes."                                                                                                                                                                 

Is there an irule extension that can detect and stop this fragmentation of TCP/TLS Data on the Client side, to ensure the TLS CLIENTSSL_HELLO is never fragmented.

3 Replies

  • Hello Kazeem_Yusuf​ 

    I noticed zamroni777 has provided you with an article and wanted to encourage an update if that has assist you or if you need additional help. 

     

  • If the receiving interface's MTU is 1500 bytes, then the max payload size is 1500 - 40 = 1460. Anything larger must be broken up / fragmented.   BIG-IP can set the DF bit, but a 1480-byte payload (1510-byte frame) is not going to fit through an interface set to 1500-bytes MTU.

    As zamruni777 indicated, the solution is to increase MTU. Jumbo Frames allows ~9000 byte MTU. But remember, if these packets are being transmitted across the pubiic internet, they will eventually get fragmented out there.