> Is it possible that I'm up against some drastic router change in the
> path between the two endpoints, such that the aggregate path is no
> longer accepting large packets passing through?
I presume this is in fact the reason. Perhaps there got some broken
piece of equipment inserted somewhere (firewalls, load balancers...)
which doesn't process fragmented packets right. With the big MTU you
always get fragmented packets, with the smaller one never.
> The carrier interface is ppp0 at this end, with an ordinary MTU of
> 1500. Might it be useful to toy with ppp0's MTU, to see how it
> interacts with varying cipcb0's as well?
1500 is almost surely too high since this is very likely to be the
maximum _somewhere_ on the path, and CIPE needs some for itself. The
41 figure you got looks a bit odd (pun intended) but correct-ish: 24
for the additional UDP/IP header plus about 16 for the encryption
The problem with less-than-1500 MTUs gets more common lately due to
the proliferation of PPPoE. There must be some good docs about that