MTU & MSS Calculator
Calculate the correct MTU and TCP MSS for tunnels, VPNs, and overlay networks with encapsulation overhead.
Your details
Additional
This calculator runs entirely on your device. Nothing you enter is uploaded, stored, or sold. How this works
Effective MTU
1,500 bytes
TCP MSS should be clamped to 1,460 bytes
Includes your inputs, the full breakdown, and every row of the table.
TCP MSS
1,460 bytes
Total overhead
0 bytes
Payload efficiency
97.3%
Application data as a share of the frame
Recommended tunnel MTU
1,500
- Physical MTU
- 1,500 bytes
- Encapsulation overhead
- - 0 bytes
- Tunnel MTU
- 1,500 bytes
- IP header (IPv4)
- - 20 bytes
- TCP header
- - 20 bytes
- TCP MSS
- 1,460 bytes
| Type | Overhead | MTU from 1500 | MSS (IPv4) |
|---|---|---|---|
| Plain Ethernet | 0 | 1500 | 1460 |
| PPPoE (DSL) | 8 | 1492 | 1452 |
| GRE | 24 | 1476 | 1436 |
| VXLAN | 50 | 1450 | 1410 |
| WireGuard | 60 | 1440 | 1400 |
| IPsec transport (AES) | ~57 | 1443 | 1403 |
| OpenVPN UDP | ~69 | 1431 | 1391 |
| IPsec tunnel (AES) | ~73 | 1427 | 1387 |
| GRE over IPsec | ~97 | 1403 | 1363 |
What this means
- Clamp MSS on tunnel interfaces rather than relying on Path MTU Discovery — many networks block the ICMP messages PMTUD depends on.
- Symptoms of an MTU mismatch are distinctive: small requests succeed, pings work, but large transfers and TLS handshakes hang. That pattern almost always means blocked ICMP plus an oversized MTU.
- IPsec overhead varies with cipher, mode, and whether NAT-T is in use. The values here are typical for AES-CBC with SHA; measure your own path if it is close to the edge.
How the mtu & mss calculation works
MTU is the largest frame a link will carry. Every layer of encapsulation — VPN, GRE, VXLAN, PPPoE — adds headers that eat into the payload, so a tunnel riding on a 1500-byte Ethernet link always has a smaller usable MTU.
MSS is the TCP-level equivalent: the effective MTU minus the IP and TCP headers. Clamping MSS on tunnel interfaces is the standard fix for MTU problems, because it tells both endpoints to send smaller segments rather than relying on Path MTU Discovery, which frequently fails when ICMP is filtered.
Frequently asked questions
What MTU should I use for a VPN?
Subtract the tunnel overhead from your path MTU. WireGuard over standard Ethernet is 1420-1440; IPsec tunnel mode is usually around 1400-1430. When in doubt, clamp MSS and test with large pings.
How do I test the real path MTU?
Send pings with the don't-fragment bit set and shrink the size until they succeed. On Linux: ping -M do -s 1472 host. On Windows: ping -f -l 1472 host. Add 28 bytes to the largest working size to get the MTU.
Related calculators
Bandwidth Calculator
Convert between bits and bytes, size a connection for concurrent users, and estimate monthly data transfer.
Tech & ITData Transfer Time Calculator
Calculate how long a file transfer will take at a given throughput, and the effective speed you actually achieve.
Tech & ITSubnet Calculator
Calculate network address, broadcast, usable host range, wildcard mask, and host count from any IPv4 address and CIDR prefix.
Tech & ITCIDR Calculator
Convert between CIDR notation and subnet masks, and see how many addresses each prefix length provides.
Tech & ITSpotted a problem, or want this calculator to do more?Corrections are fixed first, and the most-requested features get built next.Tell us →
Disclaimer. This calculator is provided for general information and educational purposes only and does not constitute financial, tax, legal, medical, or engineering advice. Results are estimates based on the inputs you provide and the assumptions described above. Confirm any figure with a qualified professional before acting on it.