Small requests work but large payloads or some HTTPS sites hang over a VPN or tunnel. What is going on?
What they are really testing: A hard senior diagnostic. They want you to reach for MTU and path-MTU-discovery black holes, the kind of subtle issue juniors never suspect.
A real interview question
Small requests work but large payloads or some HTTPS sites hang over a VPN or tunnel. What is going on?
What most people say
drag me
“The connection is probably unstable or the server is slow with big requests.”
It guesses at instability and misses the tell: small works, large hangs. That signature is almost always an MTU / PMTUD black hole, not flakiness or a slow server.
The follow-ups they ask next
Why does an HTTPS site specifically hang, when plain pings work?
The TLS handshake sends a large certificate that exceeds the path MTU, while a small ping fits. With PMTUD blocked, that big packet is dropped silently and the handshake stalls.
What is MSS clamping and why is it the practical fix?
The router rewrites the TCP maximum segment size in SYN packets so both ends agree to smaller segments that fit the tunnel MTU, sidestepping reliance on ICMP/PMTUD entirely.
What the interviewer is listening for
- Reads the small-works/large-hangs signature
- Names MTU and PMTUD black hole
- Knows MSS clamping / ICMP allow / lower MTU as fixes
What sinks the answer
- Blames instability or a slow server
- No notion of MTU
- Cannot explain why small works but large fails
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“Small works but large hangs is the tell for [an MTU / PMTUD black hole]. MTU is [the largest packet a link carries, ~1500, and tunnels lower it]. Normally [Path MTU Discovery shrinks packets via ICMP], but [if a firewall blocks that ICMP, large packets drop silently]. Fixes: [allow ICMP type 3 code 4, lower the tunnel MTU, or clamp the TCP MSS].”
Keep going with networking
Foundation
What is a VPC, and what is a subnet within it? Why split a network into subnets at all?
Foundation
What is the difference between TCP and UDP, and when would you choose each?
Foundation
What happens, step by step, when you type a URL into a browser and press enter?
Foundation
How does DNS resolution actually work, and what is the difference between an A record and a CNAME?
Foundation
What is the difference between IPv4 and IPv6, and why does IPv6 exist?
Junior
An EC2 instance in a private subnet needs to download OS updates from the internet. Walk me through how you make that work, and why.
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free