MTU / MSS Calculator
Calculate recommended MTU and MSS for tunnels, VPN and PPPoE.
MTU (Maximum Transmission Unit) and MSS (Maximum Segment Size) directly affect network performance. A wrong MTU can cause fragmentation or a PMTUD black hole, leading to slow connections or sites that simply will not load. This calculator takes a link MTU, IP version and tunnel overhead, then computes the TCP MSS and a recommended MTU in one step.
Tunnels such as PPPoE, IPsec VPN, GRE and WireGuard add their own headers, shrinking the usable payload. Use this to set the right ip tcp adjust-mss value or VPN interface MTU. If you also need to plan network ranges, see the CIDR calculator.
| Link MTU | 1500 bytes |
|---|---|
| IP header | IPv4 · 20 bytes |
| TCP header | 20 bytes |
| Tunnel overhead | 0 bytes |
| TCP MSS | 1460 bytes |
| Recommended MTU | 1500 bytes |
| MSS clamping command | ip tcp adjust-mss 1460 |
How MTU and MSS relate
MTU is the total size of the IP packet (headers included) that fits in one frame, while MSS is the maximum TCP payload (data) within it. The relationship is a simple subtraction.
- IPv4: MSS = MTU − 20 (IP header) − 20 (TCP header)
- IPv6: MSS = MTU − 40 (IP header) − 20 (TCP header)
- With a tunnel, also subtract the tunnel overhead from the formula above.
For example, standard Ethernet (MTU 1500, IPv4) gives an MSS of 1500 − 20 − 20 = 1460 bytes. PPPoE (MTU 1492) yields 1492 − 40 = 1452.
Typical tunnel overheads
Overhead varies by encryption mode (transport/tunnel) and authentication algorithm, so the values below are approximate. Verify the exact figure against your specific gear and configuration.
- PPPoE: about 8 bytes
- GRE: about 24 bytes (GRE 4 + IP 20)
- IPsec ESP (tunnel): about 50–60 bytes (depends on cipher/auth)
- WireGuard: about 60 bytes over IPv4 (80 over IPv6)
Recommended MTU and MSS clamping
The recommended MTU is the base MTU minus the tunnel overhead — the MTU you set on the tunnel interface. When you cannot change the path MTU directly, routers use MSS clamping (e.g. ip tcp adjust-mss 1400) to lower the MSS option in the SYN packet and avoid fragmentation. The value you clamp to is exactly what this calculator outputs.
Common MTU values — quick reference
Here are the standard MTUs for common link types, with the resulting IPv4/IPv6 MSS. The MSS rule is MTU − 40 for IPv4 (20 IP + 20 TCP) and MTU − 60 for IPv6 (40 IP + 20 TCP).
| Link / context | MTU | MSS (IPv4) | MSS (IPv6) | Notes |
|---|---|---|---|---|
| Ethernet (standard) | 1500 | 1460 | 1440 | Default for wired LANs and most internet paths |
| PPPoE (DSL, etc.) | 1492 | 1452 | 1432 | Smaller by the 8-byte PPPoE header |
| IPsec VPN | ~1400 | ~1360 | ~1340 | Varies with cipher/auth; conservative baseline |
| WireGuard | 1420 | 1380 | 1360 | Recommended default interface MTU for WireGuard |
| Jumbo frames | 9000 | 8960 | 8940 | Datacenter / SAN LANs (every hop must support it) |
Worked example: clamping MSS on a PPPoE link
Imagine a home or small office on a DSL line running PPPoE. The inputs and interpretation look like this.
- Input: link MTU
1492, IP version IPv4, no extra tunnel - Calculation: MSS = 1492 − 20 (IP) − 20 (TCP) =
1452bytes - Apply: set
ip tcp adjust-mss 1452on the router
Clamping to 1452 makes the router rewrite the MSS option in every TCP SYN down to 1452 or less, so both hosts only ever send segments that fit the 1492 MTU. Without clamping, hosts assume a 1500 MTU and negotiate a 1460 MSS; those packets then fragment over the PPPoE segment (1492) or — in the common case where the DF bit is set and ICMP is filtered — vanish with no reply, creating a PMTUD black hole. That is exactly the classic symptom where only large pages and downloads stall.
- Symptom: ping and small pages work, but large pages / big transfers hang → cause: PMTUD black hole (ICMP filtered + DF set) → fix: clamp MSS (1452) or lower the interface MTU to 1492