tailscale/tailscale · error

packet too big

Error message

packet too big

What it means

errPacketTooBig is returned by InjectInboundDirect and InjectOutbound when the supplied buffer exceeds MaxPacketSize (wireguard-go's MaxContentSize). The packet cannot be carried inside a WireGuard transport message, so it is rejected before any copying.

Source

Thrown at net/tstun/wrap.go:72

// burden.
const WritePacketStartOffset = device.MessageTransportHeaderSize

// MaxPacketSize is the maximum size (in bytes)
// of a packet that can be injected into a tstun.Wrapper.
const MaxPacketSize = device.MaxContentSize

// TAPDebug is whether super verbose TAP debugging is enabled.
const TAPDebug = false

var (
	// ErrClosed is returned when attempting an operation on a closed Wrapper.
	ErrClosed = errors.New("device closed")
	// ErrFiltered is returned when the acted-on packet is rejected by a filter.
	ErrFiltered = errors.New("packet dropped by filter")
)

var (
	errPacketTooBig   = errors.New("packet too big")
	errOffsetTooBig   = errors.New("offset larger than buffer length")
	errOffsetTooSmall = errors.New("offset smaller than WritePacketStartOffset")
)

// parsedPacketPool holds a pool of Parsed structs for use in filtering.
// This is needed because escape analysis cannot see that parsed packets
// do not escape through {Pre,Post}Filter{In,Out}.
var parsedPacketPool = sync.Pool{New: func() any { return new(packet.Parsed) }}

// FilterFunc is a packet-filtering function with access to the Wrapper device.
// It must not hold onto the packet struct, as its backing storage will be reused.
type FilterFunc func(*packet.Parsed, *Wrapper) filter.Response

// GROFilterFunc is a FilterFunc extended with a *gro.GRO, enabling increased
// throughput where GRO is supported by a packet.Parsed interceptor, e.g.
// netstack/gVisor, and we are handling a vector of packets. Callers must pass a
// nil g for the first packet in a given vector, and continue passing the
// returned *gro.GRO for all remaining packets in said vector. If the returned

View on GitHub (pinned to 5201273aec)

Solutions

1. Fragment or truncate the payload to fit within tstun.MaxPacketSize before injecting
2. Check the source of the oversized packet; TUN MTU should already bound it
3. Ensure the injected slice does not include stray trailing bytes beyond the packet

When it happens

Trigger: Thrown at net/tstun/wrap.go:70 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@5201273aec (2026-09-06). Data as JSON: /api/errors/e544dcc8efae9213. Report an issue: GitHub.