MTU, MSS & Tunnel Overhead Calculator

Understanding the MTU and MSS calculator — concept and principle

The MTU (maximum transmission unit) is the largest IP packet a link can carry in one frame; the MSS (maximum segment size) is the largest block of TCP payload that fits inside it. When you add a tunnel such as PPPoE, GRE, VXLAN, WireGuard or IPsec, extra headers eat into the MTU, and if nobody adjusts for it, large packets are fragmented or silently dropped. This calculator shows the inner MTU left after tunnel overhead, the TCP MSS to configure, and how much of each full Ethernet frame on the wire is useful payload.

Every header and tunnel takes bytes out of the same 1,500-byte packet (boxes not to scale).

How it is calculated

Inner MTU = link MTU − tunnel overhead.
TCP MSS = inner MTU − inner IP header (20 bytes for IPv4, 40 for IPv6) − 20-byte TCP header.
Ethernet efficiency = MSS ÷ (link MTU + 38) × 100%. The 38 bytes are the Ethernet header (14), frame check sequence (4), preamble and start delimiter (8) and inter-frame gap (12).

The tunnel overheads offered are typical values: PPPoE 8, GRE over IPv4 24, VXLAN 50, WireGuard 60 over IPv4 or 80 over IPv6, and about 73 for IPsec ESP tunnel mode with AES-GCM (ESP varies with padding and options).

The principle

Each layer wraps the one above it in its own header, like envelopes inside envelopes. The outer link limit stays fixed, so every extra envelope reduces the room left inside. TCP announces its MSS at connection setup so that the sender never builds a segment too big for the path. Routers and firewalls often "clamp" the MSS on tunnel interfaces to the smaller value so that the session never needs fragmentation.

Worked example

Inputs: link MTU 1,500, no tunnel, inner IPv4.
Inner MTU: 1,500 − 0 = 1,500 bytes.
MSS: 1,500 − 20 − 20 = 1,460 bytes.
Wire bytes per full frame: 1,500 + 38 = 1,538.
Efficiency: 1,460 ÷ 1,538 × 100 = 94.93%.
For comparison, WireGuard over IPv4 gives an inner MTU of 1,440 and an MSS of 1,400.

Each point is the calculator re-run with only “Link MTU (bytes)” changed; the gold point is the default example. Change the inputs above and this chart follows your numbers.

Link MTU (bytes)	Inner MTU
375	375
750	750
1,125	1,125
1,500	1,500
1,875	1,875
2,250	2,250
3,000	3,000

How to read the result

Use the MSS value for MSS clamping and the inner MTU for the tunnel interface MTU. About 95% is the ceiling for TCP over standard Ethernet; jumbo frames (MTU 9,000) raise it to about 99%. If websites hang while small pings work, an MTU mismatch is a classic cause.

Common mistakes

Setting the tunnel MTU equal to the physical MTU.
Forgetting that TCP options such as timestamps (12 bytes) reduce real payload per segment below the MSS.
Blocking all ICMP, which breaks Path MTU Discovery.

Keep in mind: Overheads differ by implementation and options. Confirm with your vendor documentation and test with do-not-fragment pings before deploying changes on a production network.

Frequently asked questions

Why is the MSS usually 1,460?

Because a 1,500-byte Ethernet MTU minus 20 bytes of IPv4 and 20 bytes of TCP header leaves 1,460.

What MTU should I use for PPPoE?

Typically 1,492 (1,500 − 8), with an MSS of 1,452 for IPv4.

How do I find the path MTU?

Send pings with the do-not-fragment flag and decrease the size until they pass.

Sources: IETF RFC 879, The TCP Maximum Segment Size and Related Topics · IETF RFC 1191, Path MTU Discovery · IETF RFC 8201, Path MTU Discovery for IP version 6 · IEEE 802.3, Ethernet standard

Checked 8 Nov 2026. Standard formulas and RFC/IEEE definitions, computed locally in your browser — nothing you type is sent anywhere.

Your numbers