BYTETOOLS

MTU and MSS Calculator

Work out the TCP MSS for any path MTU, subtract PPPoE, GRE, IPsec, VXLAN or WireGuard overhead, and get the exact clamp value to configure.

Encapsulation layers on the path
1500
Effective MTU
1460
TCP MSS
0
Encapsulation overhead
1460
MSS without tunnels

How the MSS was derived

LayerOverheadMTU afterMSS after
Path MTU (IPv4)Starting point — the largest IP packet the path will carry without fragmenting.—15001460

MSS = effective MTU − IP header (20) − TCP header (20) = 1500 − 20 − 20 = 1460

Clamp commands

! Cisco IOS — apply on the tunnel interface
ip tcp adjust-mss 1460

# Linux — clamp on the forwarding path
iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1460

# MikroTik RouterOS
/ip firewall mangle add chain=forward protocol=tcp tcp-flags=syn action=change-mss new-mss=1460

MSS clamping rewrites the value each end advertises in its SYN, which keeps sessions working even when Path MTU Discovery is broken by firewalls dropping ICMP "fragmentation needed" messages.

What is the MTU and MSS Calculator?

The MTU and MSS Calculator works out how much TCP payload actually fits in a packet on your path. It starts from MSS = MTU − IP header − TCP header, using 20 bytes for IPv4 or 40 for IPv6 and 20 bytes for TCP (32 when timestamps are on), then subtracts the encapsulation overhead of each tunnel you tick.

  • Correct MSS maths for IPv4 and IPv6, with and without TCP timestamps
  • Seven built-in encapsulation types with their real byte costs and an explanation of each
  • Layer-by-layer table showing the running MTU and MSS after every tunnel
  • Warns when the effective MTU drops below the IPv4 576 or IPv6 1280 floor
  • Copy-ready clamp commands for Cisco IOS, Linux iptables and MikroTik RouterOS
  • A custom overhead field for encapsulations that are not on the list

How to use the MTU and MSS Calculator

  1. 1

    Enter the path MTU — 1500 on plain Ethernet, 9000 on a jumbo-frame fabric.

  2. 2

    Pick IPv4 or IPv6, and tick TCP timestamps if they are enabled on your hosts.

  3. 3

    Tick every encapsulation layer the traffic passes through, and add any custom overhead.

  4. 4

    Read the effective MTU and MSS, then copy the clamp command for your platform.

About the MTU and MSS Calculator

The MTU and MSS Calculator works out how much TCP payload actually fits in a packet on your path. It starts from MSS = MTU − IP header − TCP header, using 20 bytes for IPv4 or 40 for IPv6 and 20 bytes for TCP (32 when timestamps are on), then subtracts the encapsulation overhead of each tunnel you tick.

PPPoE, GRE, IPsec ESP tunnel mode, VXLAN, WireGuard, L2TP and 802.1Q are all included with their real byte counts, and a layer-by-layer table shows the effective MTU and MSS after each one so you can see where the budget went. You can add your own custom overhead too.

The result includes the ready-to-paste clamp commands for Cisco IOS, Linux iptables and MikroTik. Everything is arithmetic done 100% locally in your browser — nothing about your topology is uploaded.

Frequently asked questions

How do I calculate MSS from MTU?

Subtract the IP and TCP headers: MSS = MTU − 20 − 20 for IPv4, so a 1500-byte MTU gives an MSS of 1460. Over IPv6 the IP header is 40 bytes, giving 1440, and TCP timestamps add another 12 bytes of options, bringing IPv4 down to 1448.

What MSS should I use with PPPoE?

PPPoE costs 8 bytes, so a 1500-byte Ethernet MTU becomes 1492 and the MSS becomes 1452. That is why DSL connections have used an MTU of 1492 for decades, and why clamping to 1452 fixes so many half-loading web pages.

What is the right ip tcp adjust-mss value for a GRE tunnel?

GRE adds 24 bytes — a 20-byte outer IPv4 header plus a 4-byte GRE header — so a 1500-byte path leaves a 1476-byte tunnel MTU and an MSS of 1436. Add IPsec on top and the value drops further, which is why GRE-over-IPsec designs commonly clamp around 1380.

Why does MSS clamping fix broken websites?

Path MTU Discovery relies on ICMP "fragmentation needed" messages, and many firewalls drop them. The sender then keeps retransmitting packets that are too big and the connection stalls after the handshake. Clamping the MSS in the SYN sidesteps PMTUD entirely by agreeing a safe size up front.

Does a VLAN tag reduce the MTU?

Only if the switches on the path cannot carry baby-giant frames. Most modern hardware accepts a 1522-byte frame so the IP MTU stays at 1500. On older gear that enforces a strict 1518-byte frame, the 4-byte tag does come out of the payload — which is why this calculator lets you tick it.

Related tools