TCP MSS & MTU Calculator
Free TCP MSS and MTU calculator for Ethernet, PPPoE, WireGuard, and IPsec, including the overhead and the MSS you should clamp to.
Loading tool...
What is TCP MSS & MTU Calculator?
The TCP MSS & MTU Calculator turns a base link MTU into the effective MTU and optimal TCP MSS for the tunnels people actually run — PPPoE, GRE, IPIP, VXLAN, OpenVPN, WireGuard and IPsec — with IPv4 and IPv6 MSS side by side, an overhead comparison chart, MSS-clamping guidance and a ready-to-paste ping -M do probe command.
Key Benefits
- The right MSS clamp value for any tunnel in seconds
- IPv6 MSS included, which most quick references skip
- Overhead chart to compare encapsulations before you design
- Custom overhead row for values measured on your own network
- Fragmentation-avoidance guidance that names the actual commands
Common Use Cases
- •Fixing stalls where large transfers hang but small requests work
- •Sizing MSS for a new WireGuard or IPsec site-to-site link
- •Setting MTU on a PPPoE broadband router
- •Comparing VPN overhead before choosing a protocol
- •Verifying a path with a do-not-fragment probe after changes
How to Size TCP MSS for a Tunnel
- Enter the link MTU: Type the MTU of the physical link — 1500 for standard Ethernet, 1492 on PPPoE lines, up to 9000 for jumbo frames.
- Find your encapsulation: Read the row for your tunnel: PPPoE, GRE, VXLAN, OpenVPN, WireGuard or IPsec. Effective MTU is the link MTU minus that header overhead.
- Set the MSS clamp: Apply the IPv4 or IPv6 MSS value with iptables -j TCPMSS --clamp-mss-to-pmtu or the router equivalent so clients advertise a size that fits the tunnel.
- Probe the real path: Paste the ping -M do command to verify: if the probe with your effective MTU payload gets through without fragmentation, the clamp is right.
Key Features
- Effective MTU and MSS for nine common encapsulations
- IPv4 and IPv6 TCP MSS computed side by side
- Custom overhead row for your own measurements
- Overhead bar chart comparing header costs
- Fragmentation guidance and a ready-to-paste ping -M do probe
Frequently Asked Questions
Why is TCP MSS smaller than the MTU?
MSS counts only the TCP payload. IPv4 adds a 20-byte IP header and TCP adds 20 more, so a 1500-byte link carries at most 1460 bytes of payload; IPv6 adds a 40-byte header, leaving 1440. Tunnels subtract their own header overhead first, which is what the calculator works out.
Which MSS should I clamp to for WireGuard?
WireGuard adds about 60 bytes of overhead over IPv4, so a 1500-byte link gives an effective MTU of 1440 and an IPv4 MSS of 1380. Clamping to that value — or letting clamp-mss-to-pmtu discover it — prevents silent drops on the encrypted path.
What does ping -M do actually test?
It sets the do-not-fragment flag, so the probe either arrives whole or fails with "message too long" instead of being fragmented. Binary-searching the payload size finds the real path MTU; the calculator pre-computes the payload that matches your effective MTU.
Are the overhead values exact?
They are typical IPv4 figures. The real overhead depends on the cipher (AES-GCM is leaner than AES-CBC with SHA-1), NAT traversal additions, and whether the transport is IPv4 or IPv6. Measure on your own network with the probe command and enter the value in the custom field.