MTU / MSS Calculator
Calculate the effective MTU and correct TCP MSS for any stack of encapsulations, so tunnelled traffic stops hanging on large packets.
Result
Overhead breakdown
| Element | Bytes |
|---|---|
| Base MTU | 1500 |
| PPPoE | -8 |
| Plain Ethernet | -0 |
| Effective MTU | 1492 |
| IPv4 header | -20 |
| TCP header | -20 |
| TCP MSS | 1452 |
# MikroTik RouterOS - clamp MSS on the tunnel/PPPoE path
/ip firewall mangle
add chain=forward action=change-mss new-mss=1452 protocol=tcp tcp-flags=syn passthrough=yes comment="Netvorx MSS clamp"
# or clamp to path MTU automatically
add chain=forward action=change-mss new-mss=clamp-to-pmtu protocol=tcp tcp-flags=syninterface Tunnel0
ip mtu 1492
ip tcp adjust-mss 1452set interfaces gr-0/0/0 unit 0 family inet mtu 1492
set security flow tcp-mss all-tcp mss 1452iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1452
# or
iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtuAbout MTU / MSS Calculator
Every encapsulation steals bytes from the payload. Get the arithmetic wrong and you get the worst kind of fault: pings work, SSH works, and large transfers hang forever. This calculates the effective MTU and the MSS to clamp for any stack of encapsulations.
Diagnosing a PMTU black hole
The signature is unmistakable once you know it: small requests succeed, large ones hang. SSH connects and then freezes on a verbose command, a web page returns headers but never finishes, a VPN passes ping but not file transfers. The cause is a device on the path that drops oversized packets without returning ICMP type 3 code 4, so the sender never learns to reduce its segment size. Confirm with ping -M do at descending sizes, then fix it by clamping MSS at the tunnel edge rather than hoping ICMP starts working.
Common overheads
PPPoE costs 8 bytes, giving the familiar 1492. A VLAN tag costs 4, QinQ 8. GRE is 24, WireGuard about 60, and IPsec ESP in tunnel mode can reach 73 bytes worst case depending on cipher and padding. Stacking them compounds: IPsec over PPPoE leaves under 1420 bytes, and any device assuming 1500 in that path will black-hole large packets.
Common use cases
- Fixing "some websites do not load" complaints on a PPPoE or tunnelled service.
- Sizing tunnel interface MTU before deploying a VPN.
- Setting MSS clamping on a BNG for subscriber traffic.
Edge cases and gotchas
- IPsec overhead varies with cipher, mode and padding - use the worst case and leave margin.
- MSS clamping only helps TCP. UDP-based protocols such as QUIC need correct PMTUD or their own probing.