Counts IP datagrams that needed fragmentation to be forwarded but could not be, for example because their Don't Fragment flag was set. This counter is the direct signature of a Path MTU Discovery black hole; when DF-set packets can't be fragmented and the required ICMP fragmentation-needed message doesn't get back to the sender, often because it's blocked elsewhere, connections mysteriously hang rather than failing cleanly. Example: ipFragFails climbing on the tunnel interface exactly when users report large file transfers over VPN hanging, while small transactions work fine, is the classic PMTUD black-hole symptom.