MTU / MSS Calculator
Calculate recommended MTU and MSS for tunnels, VPN and PPPoE.
MTU (Maximum Transmission Unit) and MSS (Maximum Segment Size) directly affect network performance. A wrong MTU can cause fragmentation or a PMTUD black hole, leading to slow connections or sites that simply will not load. This calculator takes a link MTU, IP version and tunnel overhead, then computes the TCP MSS and a recommended MTU in one step.
Tunnels such as PPPoE, IPsec VPN, GRE and WireGuard add their own headers, shrinking the usable payload. Use this to set the right ip tcp adjust-mss value or VPN interface MTU. If you also need to plan network ranges, see the CIDR calculator.
| Link MTU | 1500 bytes |
|---|---|
| IP header | IPv4 · 20 bytes |
| TCP header | 20 bytes |
| Tunnel overhead | 0 bytes |
| TCP MSS | 1460 bytes |
| Recommended MTU | 1500 bytes |
| MSS clamping command | ip tcp adjust-mss 1460 |
How MTU and MSS relate
MTU is the total size of the IP packet (headers included) that fits in one frame, while MSS is the maximum TCP payload (data) within it. The relationship is a simple subtraction.
- IPv4: MSS = MTU − 20 (IP header) − 20 (TCP header)
- IPv6: MSS = MTU − 40 (IP header) − 20 (TCP header)
- With a tunnel, also subtract the tunnel overhead from the formula above.
For example, standard Ethernet (MTU 1500, IPv4) gives an MSS of 1500 − 20 − 20 = 1460 bytes. PPPoE (MTU 1492) yields 1492 − 40 = 1452.
Typical tunnel overheads
Overhead varies by encryption mode (transport/tunnel) and authentication algorithm, so the values below are approximate. Verify the exact figure against your specific gear and configuration.
- PPPoE: about 8 bytes
- GRE: about 24 bytes (GRE 4 + IP 20)
- IPsec ESP (tunnel): about 50–60 bytes (depends on cipher/auth)
- WireGuard: about 60 bytes over IPv4 (80 over IPv6)
Recommended MTU and MSS clamping
The recommended MTU is the base MTU minus the tunnel overhead — the MTU you set on the tunnel interface. When you cannot change the path MTU directly, routers use MSS clamping (e.g. ip tcp adjust-mss 1400) to lower the MSS option in the SYN packet and avoid fragmentation. The value you clamp to is exactly what this calculator outputs.