MTU & MSS Calculator

Two numbers decide how much data fits into a packet. The MTU is the largest IP packet a link can carry. The MSS is the largest chunk of data TCP puts into one segment, and it has to be small enough that headers plus data fit inside the MTU. When the two disagree, large transfers stall in ways that are hard to diagnose. The page works out the right MSS for a given MTU, header choices and tunnel type.

The arithmetic

Start from the MTU. Subtract the IP header: 20 bytes for IPv4 without options, 40 for IPv6. Subtract the TCP header: 20 bytes, or 32 when the timestamps option is in use, which most modern systems enable. What remains is the MSS. For the default Ethernet MTU of 1500 with IPv4 and timestamps, the MSS is 1500 − 20 − 32 = 1448; without timestamps it is 1460. For UDP you subtract 20 and 8, so the largest payload is 1472. Tunnels reduce the usable MTU first, because their own headers sit inside the 1500 bytes: PPPoE costs 8, GRE 24, VXLAN 50, WireGuard 60 over IPv4 or 80 over IPv6.

Using the page

Enter the link MTU, choose the encapsulation, the IP version and whether TCP timestamps are on, or press one of the presets (Ethernet, PPPoE DSL, WireGuard over IPv4, Jumbo frames). Extra overhead lets you add bytes for a tunnel that is not listed, for example IPsec. The result gives the usable MTU inside the tunnel, the IP and TCP header sizes, the MSS to configure, the largest UDP and ping payloads, the Ethernet frame size and the efficiency. The table at the bottom compares every encapsulation at MTU 1500.

Why wrong values cause trouble

Path MTU discovery depends on routers sending an ICMP “fragmentation needed” message when a packet is too large and has the don’t-fragment flag set. Firewalls that drop ICMP break it. The symptom is a connection that works for small exchanges, such as a login or a handshake, and freezes on larger ones. Setting the MSS on a gateway (“MSS clamping”) shrinks segments before they enter the tunnel, so oversize packets never exist. The right number is exactly what this page returns.

A worked example

With the defaults, MTU 1500, plain Ethernet, IPv4 and TCP timestamps, the result is an MSS of 1448 bytes, a largest UDP and ping payload of 1472, an Ethernet frame of 1518 bytes and a payload share of 94.15 % of the line rate. Switch to PPPoE and the usable MTU becomes 1492 and the MSS 1440. WireGuard over IPv4 gives an MTU of 1440 and an MSS of 1388; over IPv6 it is 1420 and 1368.

Limits

The page assumes standard header sizes without IP options. IPsec, GRE with keys and vendor tunnels have overheads that depend on configuration, and must be entered in the extra overhead field. The real path may contain a link with a smaller MTU than the one you enter, in which case measure it with a don’t-fragment ping.

Related tools

• Network Goodput Calculator shows how header overhead limits real throughput.
• TCP Window Calculator covers the other limit on a single connection’s speed.
• Packets per Second Calculator relates frame size to line-rate packet counts.
• WireGuard Config Generator builds the tunnel whose MTU you just calculated.