MTU & MSS Calculator
The MTU left inside your tunnels and the MSS to clamp to, byte by byte.
Try before you buy.
- Free preview: the MTU inside your stack of layers, with the first rows of the layer and frame tables; the MSS, the overhead, the line rate and the commands are hidden.
- Locked until you unlock it: download and copy.
- Unlock: Pro pass, ₹179 for 30 days or ₹79 for 1 week, a one-time payment that never renews. Unlock: Pro pass, $5.99 for 30 days or $2.99 for 1 week, a one-time payment that never renews.
Ways to unlock shows how to get the full result.
Printing this result is locked in the free preview.
Result
Layer by layer
At line rate
Set it on Linux
Replace <tunnel-interface> with yours. --set-mss only lowers the MSS of TCP handshakes passing the router; --clamp-mss-to-pmtu instead follows each route’s MTU.
Locked in the free preview. Opens the ways to unlock this result.
Locked in the free preview. Batch runs unlock with a pass.
Locked in the free preview. Query results unlock with a pass.
About the MTU & MSS Calculator
Every tunnel puts its own headers in front of your packets, and the link underneath does not grow to make room for them. A packet that was the right size for Ethernet becomes too big once it is wrapped in WireGuard, IPsec or GRE, and is then fragmented or dropped — the classic symptom is a VPN where ping works but large pages and file transfers hang. The fix is to lower the MTU of the tunnel interface and to clamp the TCP MSS so connections never send segments that do not fit.
Add the layers your traffic passes through — PPPoE, MPLS labels, IP-in-IP (6in4, 4in6), GRE with or without a key, IPsec ESP in tunnel or transport mode with AES-GCM, ChaCha20-Poly1305 or AES-CBC and NAT traversal, WireGuard, OpenVPN over UDP or TCP, VXLAN — in the order they sit on the link. The calculator adds up each header from its specification, including the block padding of AES-CBC, and gives the MTU left inside, the MSS for IPv4 and IPv6, what full-size frames carry at line rate and the Linux commands that set it.
Without a pass, the free preview shows the MTU inside the stack in full, with the first rows of the layer and frame tables; the MSS values, the overhead, the line-rate figures and the commands, the copied summary and the download unlock with a Pro pass.
How to use it
- Pick a common stack to start from, or enter the MTU of the link underneath (1500 for Ethernet, 9000 for jumbo frames).
- Add the layers in the order they sit on the link — for example PPPoE first, then WireGuard — and set each one’s options: outer IP version, cipher, NAT traversal, GRE key.
- Choose the IP version of your traffic inside the tunnel and whether TCP timestamps are on.
- Read the MTU inside the stack and the MSS to clamp to; set the MTU on the tunnel interface and the MSS on the router.
- Optionally turn on Line rate to see the frame size, packets per second and TCP data rate at the link speed. With a pass, copy the summary or download it (in the free preview they stay locked).
Examples
1500 − 20 (IPv4) − 8 (UDP) − 16 (WireGuard header) − 16 (Poly1305 tag) = 1440 MSS 1400 for IPv4, 1380 for IPv6
Over IPv6 it is 1420 — the MTU wg-quick sets when you give none, so it works over both.
1500 − 8 (PPPoE) = 1492 → − 60 (WireGuard over IPv4) = 1432 · MSS 1392
1500 − 20 (outer IPv4) − 8 (UDP) − 8 (SPI, sequence) − 8 (IV) − 2 (trailer) − 16 (ICV) = 1438
1500 − 20 − 8 − 16 (IV) − 12 (ICV) = 1444 bytes for the encrypted part → 1440 (90 blocks of 16) → packet 1438; 4 bytes cannot be used
1500 − 20 − 8 (UDP) − 8 (VXLAN) − 14 (inner Ethernet) = 1450
64-byte frames: 1,488,095 packets per second · 1,518-byte frames: 81,274 per second, 94.93% of the line as TCP data
Common uses
- Choose the MTU of a WireGuard or OpenVPN interface that runs over a PPPoE fibre or DSL line.
- Work out the MSS clamp for a site-to-site IPsec tunnel with NAT traversal.
- Size the underlay MTU of a VXLAN fabric so 1,500-byte packets inside never fragment.
- Explain why large downloads stall over a VPN while ping and small pages work.
- Estimate packets per second and usable throughput for a link before buying a firewall or router.
What each layer adds
- PPPoE: 6-byte PPPoE header and 2-byte PPP protocol ID, so the MTU is at most 1,492 (RFC 2516 §7).
- MPLS: 4 bytes per label (RFC 3032).
- IP-in-IP, 6in4, 4in6 (DS-Lite): one outer header, 20 bytes for IPv4 or 40 for IPv6 (RFC 2003, RFC 4213, RFC 6333).
- GRE: outer IP header plus 4 bytes, and 4 more each for a checksum, a key or a sequence number (RFC 2784, RFC 2890).
- IPsec ESP: outer IP header in tunnel mode, 8 bytes of SPI and sequence number, the IV, padding so that the encrypted part (payload, padding, pad length and next header) is a whole number of the cipher’s blocks, and the ICV (RFC 4303). AES-GCM: 8-byte IV, 16-byte ICV (RFC 4106); ChaCha20-Poly1305: 8 and 16 (RFC 7634); AES-CBC: 16-byte IV and 16-byte blocks (RFC 3602) with a 12-byte HMAC-SHA1-96 (RFC 2404) or 16-byte HMAC-SHA-256-128 ICV (RFC 4868). NAT traversal adds an 8-byte UDP header (RFC 3948).
- WireGuard: outer IP header, 8-byte UDP header, 16 bytes of message header (type, reserved, receiver index, counter) and the 16-byte Poly1305 tag: 60 bytes over IPv4, 80 over IPv6 (WireGuard whitepaper §5.4.6).
- OpenVPN with an AEAD cipher and DATA_V2 packets: outer IP and UDP headers, 4 bytes of opcode, key ID and peer ID, a 4-byte packet ID (8 in the epoch format) and a 16-byte tag; over TCP a 20-byte TCP header and a 2-byte length instead of UDP; a TAP tunnel also carries the 14-byte Ethernet header.
- VXLAN: outer IP header, UDP 8, VXLAN header 8 and the 14-byte inner Ethernet header (the inner frame travels without its FCS, RFC 7348 §5).
Sources: RFC 2516, RFC 3032, RFC 2784, RFC 2890, RFC 4303, RFC 4106, RFC 7634, RFC 3602, RFC 3948, RFC 7348, WireGuard whitepaper, wg-quick’s script (its MTU without a setting: the route’s MTU − 80), OpenVPN wire protocol.
MTU, MSS and clamping
The MTU is the largest IP packet a link carries. The MSS is the largest piece of TCP data one segment carries, and each side announces it when a connection opens: the MTU minus the fixed IP header (20 bytes for IPv4, 40 for IPv6) and the fixed 20-byte TCP header. TCP options such as timestamps are not subtracted from the announced MSS; the sender leaves room for them itself (RFC 9293 §3.7.1).
Path MTU discovery should find a smaller MTU by itself, but it depends on ICMP “packet too big” messages that firewalls often drop. Clamping the MSS on the router that adds the tunnel — iptables … -j TCPMSS --set-mss or --clamp-mss-to-pmtu, tcp option maxseg size set in nftables — rewrites the MSS in every TCP handshake that passes it, so TCP never sends segments too big for the tunnel. It does nothing for UDP traffic; that needs the right MTU on the tunnel interface.
Line rate: frames on the wire
Each Ethernet frame also needs 8 bytes of preamble and start-of-frame delimiter and 12 bytes of inter-frame gap, and a frame is at least 64 bytes from its destination address to its FCS. A full 1,500-byte packet therefore takes 1,538 bytes on the wire (1,542 with one 802.1Q tag), and small packets waste most of the line: at 1 Gbit/s, 64-byte frames come at most 1,488,095 times a second. The frame sizes in the table are the ones of RFC 2544 §9.
Limitations
- Headers are counted without options: IPv4 or TCP options, IPv6 extension headers, IPsec with ESN or other ciphers and OpenVPN compression framing add bytes.
- The MTU of a path is set by its smallest link. If a link further along has a smaller MTU than yours, use that one.
- OpenVPN’s figures are for AEAD ciphers (AES-GCM, ChaCha20-Poly1305); the old CBC ciphers add more. Some vendors’ IPsec and SD-WAN products add headers of their own.
- VLAN tags do not reduce the MTU on equipment that carries 1,522-byte tagged frames; they do count in the frame size at line rate.
Privacy
On this device: nothing is sent
Everything is calculated in your browser. Nothing you enter is uploaded or stored.
Frequently asked questions
What do I get without a pass?
Without a pass, MTU & MSS Calculator shows the MTU inside your stack of layers, with the first rows of the layer and frame tables; the MSS, the overhead, the line rate and the commands are hidden. Until you unlock it, the result can’t be downloaded or copied. A Pro, Premium or Ultimate pass, a one-time payment that never renews, unlocks the full result. The pricing page lists the passes and their prices.
What MTU should I use for WireGuard?
On a 1,500-byte link, 1440 if the tunnel runs over IPv4 and 1420 over IPv6. wg-quick uses the route’s MTU minus 80 when you set none, so 1420 works over both. Over PPPoE (1,492) it is 1432 over IPv4 and 1412 over IPv6.
What is the difference between MTU and MSS?
The MTU is the largest packet, headers included; the MSS is the largest TCP data in one segment. For IPv4 the MSS is the MTU minus 40 bytes (20 IP, 20 TCP), for IPv6 minus 60: an MTU of 1500 gives MSS 1460 and 1440.
Why is the PPPoE MTU 1492?
PPPoE puts a 6-byte PPPoE header and a 2-byte PPP protocol ID inside the 1,500-byte Ethernet payload, so 1,492 bytes are left for IP (RFC 2516 §7).
How much overhead does IPsec add?
It depends on the cipher and mode. On a 1,500-byte link, AES-GCM in tunnel mode over IPv4 takes 54 bytes, 62 with NAT traversal. AES-CBC has a 16-byte IV and pads the encrypted part to whole 16-byte blocks, so it takes more: 62 bytes with HMAC-SHA1-96 on the same link, 4 of them lost to the block alignment. The calculator shows the exact figure for your settings.
Does a VLAN tag reduce the MTU?
Not on standard equipment: an 802.1Q tag makes the frame 4 bytes longer (1,522 bytes), and switches carry that, so the IP MTU stays 1500. Two tags (QinQ) need 1,526-byte frames; where the path cannot carry them, the MTU must drop by 4 bytes.