diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index a2a796c..c418829 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c

@@ -1837,11 +1837,13 @@ static int tcp_mtu_probe(struct sock *sk)
        struct tcp_sock *tp = tcp_sk(sk);
        struct inet_connection_sock *icsk = inet_csk(sk);
        struct sk_buff *skb, *nskb, *next;
+       struct net *net = sock_net(sk);
        int len;
        int probe_size;
        int size_needed;
        int copy;
        int mss_now;
+       int interval;

        /* Not currently probing/verifying,
         * not in recovery,

@@ -1854,11 +1856,17 @@ static int tcp_mtu_probe(struct sock *sk)
            tp->rx_opt.num_sacks || tp->rx_opt.dsack)
                return -1;

-       /* Very simple search strategy: just double the MSS. */
+       /* Use binary search for probe_size bewteen tcp_mss_base,
+        * and current mss_clamp. if (search_high - search_low)
+        * smaller than a threshold, backoff from probing.
+        */
        mss_now = tcp_current_mss(sk);
-       probe_size = 2 * tp->mss_cache;
+       probe_size = (icsk->icsk_mtup.search_high +
+                     icsk->icsk_mtup.search_low) >> 1;
        size_needed = probe_size + (tp->reordering + 1) * tp->mss_cache;
-       if (probe_size > tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_high)) {
+       interval = icsk->icsk_mtup.search_high - icsk->icsk_mtup.search_low;
+       if (probe_size > tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_high) ||
+           interval < net->ipv4.sysctl_tcp_probe_threshold) {
                /* TODO: set timer for probe_converge_event */
                return -1;
        }