MTU & TCP MSS Calculator & Overhead Analyzer
Calculate the exact TCP Maximum Segment Size (MSS) across VPN tunnels, PPPoE connections, and VLANs. Prevent packet fragmentation, eliminate MTU black holes, and generate router clamping commands.
Network Interface & Protocol Parameters:
Maximum data payload a TCP segment can carry without fragmentation
Payload Efficiency: 96.5% of wire MTU
IP (20B) + TCP (32B) + Tunnels (0B)
Router & Firewall TCP MSS Clamping Configurations
Apply MSS clamping on router / gateway interfaces to prevent packet fragmentation over VPNs and PPPoE:
iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtuiptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1448interface GigabitEthernet0/1 ip tcp adjust-mss 1448
Ping Command with "Do Not Fragment" (DF) Bit:
Run these terminal commands to test whether packets of this size can traverse your ISP link without encountering fragmentation:
-M do -s 1472):ping -M do -s 1472 1.1.1.1-f -l 1472):ping -f -l 1472 1.1.1.1Demystifying MTU, MSS & Path MTU Discovery (PMTUD)
01.The Mathematical Difference Between MTU and MSS
In computer networking, MTU (Maximum Transmission Unit) and MSS (Maximum Segment Size) describe packet size limits at different layers of the OSI model:
- MTU (Layer 3 / Network): The total size of the IP packet including IP headers, transport headers, and payload that a link can transmit without fragmentation. Standard Ethernet is 1,500 bytes.
- MSS (Layer 4 / Transport): The maximum amount of pure application data that a TCP segment can hold.
On a standard IPv4 Ethernet network:
On an IPv6 network, the base IP header is 40 bytes, yielding an MSS of 1,440 bytes.
02.Why VPNs & PPPoE Cause MTU Headaches
When packets are encapsulated inside a VPN tunnel (such as WireGuard, IPsec, or OpenVPN), an additional outer IP header and cryptographic wrapper are appended to each packet.
If your underlying physical internet connection has an MTU of 1,500 bytes, sending a 1,500-byte packet into a WireGuard tunnel produces a 1,532-byte packet on the physical wire!
Because standard Ethernet switches cannot transmit frames larger than 1,500 bytes, one of two things happens:
- The router fragments the packet into two pieces, doubling packet processing overhead and latency.
- If the "Do Not Fragment" (DF) bit is set, the router discards the packet completely.
03.The Path MTU Discovery (PMTUD) Black Hole
Under RFC 1191, when a router receives a packet with the "Do Not Fragment" (DF) flag that exceeds link MTU, it must drop the packet and send back an ICMP Type 3 Code 4 ("Fragmentation Needed") message containing the next-hop MTU.
Unfortunately, many misconfigured enterprise firewalls and cloud security groups blanket-block all ICMP messages.
The sending server never receives the notification; it keeps retransmitting the oversized packet until the TCP connection hangs indefinitely. This phenomenon is known as a PMTU Black Hole. Web pages appear to load partial headers, then freeze forever on large image/API payloads.
04.The Cure: TCP MSS Clamping
The most robust solution for routers and VPN gateways is TCP MSS Clamping:
During the initial TCP 3-way handshake, the router inspects the SYN packet and transparently rewrites the client's advertised MSS value to match the tunnel's Path MTU:
Both endpoints are forced to negotiate smaller segment sizes from the start, completely avoiding fragmentation without requiring any client-side configuration changes.