📏

MTU & TCP MSS Calculator

Work out the effective MTU and TCP MSS once tunnel and encapsulation overhead is subtracted — PPPoE, GRE, IPsec, VXLAN, MPLS and more.

Link & Encapsulation
Effective Values
1500
Effective MTU
1460
TCP MSS (IPv4)
1440
TCP MSS (IPv6)
0
Total overhead
Test Commands (Path MTU Discovery)
Windows — don’t-fragment ping (payload = MTU − 28)
ping 8.8.8.8 -f -l 1472
Linux
ping -M do -s 1472 8.8.8.8
macOS
ping -D -s 1472 8.8.8.8

About the MTU Calculator

The Maximum Transmission Unit is the largest packet a link can carry. Standard Ethernet allows 1500 bytes, but every tunnel or encapsulation layer you add — PPPoE, GRE, IPsec, VXLAN, MPLS — steals part of that budget. If devices keep sending 1500-byte packets into a tunnel that can only carry 1400, the result is fragmentation or silently dropped packets, which shows up as web pages half-loading, VPN file copies stalling and VoIP working while HTTPS fails.

This calculator subtracts the overhead of each selected encapsulation from your base MTU and shows the effective MTU plus the TCP MSS you should clamp to (MSS = MTU minus 40 bytes for IPv4 or 60 bytes for IPv6 headers). It also generates ready-to-paste don’t-fragment ping commands so you can verify the real path MTU empirically. Note that IPsec overhead varies with cipher and mode — the value used here is a typical worst case for AES-CBC with SHA-1 in tunnel mode.

How to Use This Tool

1
Set the base MTU — 1500 for standard Ethernet, or your WAN circuit's value.
2
Select every encapsulation on the path: PPPoE, GRE, IPsec variants, VXLAN, and set the MPLS label count if applicable — overheads stack.
3
Read the effective MTU and the TCP MSS you should clamp to (MSS = MTU − 40 for IPv4, − 60 for IPv6).
4
Apply the MSS clamp on the tunnel interface and re-test the traffic that was failing.

Common Use Cases

  • 🔌
    "VPN connects but some sites won't load." The signature MTU ticket: small packets (ping, DNS) work, large ones (HTTPS pages, file transfers) hang. Calculate the tunnel's real MTU and clamp MSS.
  • 🏠
    NBN and PPPoE links. PPPoE steals 8 bytes, making the effective MTU 1492 — the most common overlooked overhead on Australian broadband connections.
  • 🌐
    Site-to-site IPsec tunnels. Stack GRE-over-IPsec overheads correctly instead of guessing, and stop the intermittent application timeouts that follow.
  • ☁️
    Overlay networks. VXLAN adds 50 bytes; get the underlay MTU right (or jumbo frames configured) before the overlay misbehaves under load.
  • 🧪
    Path MTU verification. Predict what ping -f -l (Windows) or ping -M do -s (Linux) should show, then confirm the theory on the wire.

Typical Symptoms of MTU Problems

  • 🌐
    Some sites load, others hang. Small packets pass, full-size packets are dropped — classic PMTUD black hole.
  • 🔒
    VPN connects but transfers stall. The tunnel reduced effective MTU and large TCP segments no longer fit.
  • 📧
    Email works, attachments fail. Small control traffic fits; bulk data hits the reduced MTU.
  • 🛠️
    Fix: clamp TCP MSS on the router (e.g. ip tcp adjust-mss) or lower the interface MTU.

Frequently Asked Questions

Why do small pings work but web pages hang?
Pings are small enough to fit under the reduced tunnel MTU; full-size 1500-byte TCP segments are not. When the oversized packet has the don't-fragment bit set and the ICMP "fragmentation needed" message is blocked by a firewall, the sender never learns to shrink — packets silently vanish. That's a PMTUD black hole, and MSS clamping is the standard fix.
Should I just enable jumbo frames instead?
Only inside a network you fully control end-to-end (storage VLANs, hypervisor backbones). Across the internet or any third-party link, jumbo frames don't survive, and a mismatched segment quietly drops large packets — the exact problem you were trying to avoid.
Why is the ping payload MTU minus 28?
An ICMP echo carries a 20-byte IPv4 header plus an 8-byte ICMP header. To test a 1500-byte MTU you send a 1472-byte payload with the don’t-fragment flag set. If it fails, step the size down until it passes.
What MSS should I clamp on a PPPoE connection?
PPPoE takes 8 bytes, so the MTU is 1492 and the IPv4 MSS is 1452. Many ISP routers do this automatically, but firewalls in bridge mode often do not.
Does VLAN tagging reduce MTU?
Usually not — most switches allow 1504-byte frames to fit the 4-byte 802.1Q tag. It is included here for links where the hardware genuinely cannot exceed 1500 bytes on the wire.