MTU and TCP MSS Calculator
Work out the TCP MSS and maximum UDP payload for a given MTU, with the overhead of PPPoE, GRE, WireGuard, VXLAN and other tunnels subtracted.
TCP MSS
1,460
Max UDP payload
1,472
MSS clamp
--set-mss 1460
How it adds up (bytes)
How to use
- Enter the MTU of the narrowest link on the path — 1500 on Ethernet, 1492 behind PPPoE, whatever your tunnel interface reports.
- Pick IPv4 or IPv6, and the encapsulation if the traffic is tunnelled. Each option shows the bytes it costs and what they are made of.
- Read the MSS, the maximum UDP payload and the ready-made clamp value, and check the breakdown underneath if a number looks wrong.
About this tool
ShowHide
MSS is what is left of the MTU once the headers have taken their share. On plain Ethernet that is 1500 minus a 20-byte IPv4 header minus a 20-byte TCP header, giving the familiar 1460; the same link over IPv6 gives 1440, because the IPv6 header is 40 bytes with no options field. Enter an MTU and this works the subtraction both ways and shows every step, so the number can be checked rather than taken on faith.
Encapsulation is where the arithmetic usually goes wrong, so the overheads are listed with their parts rather than as totals. PPPoE costs 8 bytes — a 6-byte header plus the 2-byte PPP protocol id — which is why DSL links run at 1492 and hand back an MSS of 1452. GRE over IPv4 costs 24: an outer 20-byte IP header plus 4 bytes of GRE. WireGuard costs 60 over IPv4 and 80 over IPv6, made of the outer IP header, 8 bytes of UDP, 16 bytes of WireGuard message header and a 16-byte Poly1305 tag — which is where the recommended 1420 MTU comes from. VXLAN costs 50, because it carries a whole inner Ethernet header inside UDP.
Two things the tool will tell you that a bare subtraction will not. It warns when nothing is left for payload, which happens sooner than people expect once tunnels are stacked. And it warns when the path falls below 1280 bytes, because that is the minimum link MTU IPv6 requires: a link narrower than that cannot carry IPv6 at all, no matter how small the packets are, since fragmentation is not available to routers in IPv6.
The TCP options field is there because the MSS you advertise and the payload you actually get are not the same figure. MSS is negotiated from the base 20-byte header, but timestamps and SACK take about 12 bytes out of every segment once padded, so a session that negotiated 1460 is really moving 1448. Leave the field at 0 for the value to advertise or clamp to, and raise it when you are accounting for what a live session carries.
Frequently asked questions
Why is the MSS 1460 and not 1500?
Because MSS measures the TCP payload only. A 1500-byte MTU has to fit the IP header and the TCP header inside it, and both are 20 bytes at minimum, so 1460 bytes are left for data. Over IPv6 the header is 40 bytes rather than 20, so the same MTU yields 1440.
What is MSS clamping and when do I need it?
It rewrites the MSS in the SYN packets passing through a router so both ends negotiate a size that fits the real path. You need it when something on the path has a smaller MTU and the ICMP messages that would normally announce that are being dropped — the classic symptom is a connection that opens fine and then hangs on the first large transfer.
Do I subtract the Ethernet header too?
No. MTU is already defined as the payload an interface will carry, so the 14-byte Ethernet header and the 4-byte frame check sequence sit outside it: a 1500-byte MTU rides in a 1518-byte frame. Subtract them and you will end up 18 bytes short.
Why does IPv6 have a 1280-byte floor?
Because IPv6 routers are not allowed to fragment packets in transit — only the sending host may fragment. To keep that workable the specification requires every link to carry at least 1280 bytes, so a tunnel that leaves less than that is not a usable IPv6 path even if small packets happen to get through.
Is the IPsec overhead in the list?
No, because it is not a fixed number. ESP in tunnel mode adds an outer IP header, an 8-byte ESP header, an initialisation vector, padding up to the cipher block size and an integrity check value, and the total depends on the cipher suite and on how much padding a given packet needs. Work out the figure for your configuration and subtract it from the MTU before entering it here.
Related tools
Port Number Reference
Searchable cheat sheet for ~60 standard TCP / UDP port numbers — from 22 (SSH) and 80 (HTTP) to 6379 (Redis) and 27017 (MongoDB).
Network
IP Address Inspector
Type an IPv4 or IPv6 address and see its class, scope (private / public / loopback / link-local), decimal value, binary, reverse-DNS notation, and /32 CIDR.
Network
MAC to EUI-64 / Link-local
Convert any MAC address into its modified EUI-64 interface ID and the matching IPv6 link-local address — the same form Windows / Linux compute automatically.
Network
IPv6 Expander / Compressor
Toggle any IPv6 address between its shorthand ::1 form and the fully-expanded 8-group representation, with reverse DNS and binary too.
Network
CIDR Aggregator (Merge & Summarize IP Ranges)
Coalesce a messy list of IPv4/IPv6 addresses, CIDR blocks, and ranges into the smallest equivalent set of CIDR prefixes.
Network
Subnet Calculator (IPv4 / CIDR)
Parse an IPv4 CIDR into network address, broadcast, netmask, wildcard, host range, and class. Shows binary breakdown and private/public status.
Network