MTU, MSS, and tunnel overhead

The MTU (Maximum Transmission Unit) is the largest IP packet an interface will send without fragmenting — classically 1500 bytes on Ethernet. TCP negotiates an MSS (Maximum Segment Size), the largest payload per segment, by subtracting the IP and TCP headers from the MTU.

MSS = MTU − IP header (20/40) − TCP header (20)  ·  1500 − 40 = 1460 for IPv4

Why tunnels break things

Every layer of encapsulation — GRE, VXLAN, IPsec, WireGuard, PPPoE, QinQ — adds header bytes, shrinking the room left for your payload. If the inner host still believes the MTU is 1500 but the tunnel can only carry 1400, large packets are dropped or fragmented and the classic “small pings work, big transfers hang” ticket appears. This tool computes the effective inner MTU/MSS after that overhead so you can clamp it correctly.

Path-MTU Discovery (PMTUD) is meant to detect this automatically, but firewalls that drop ICMP “fragmentation needed” messages silently defeat it — which is why manual MSS clamping at the tunnel edge is so common.

Related