Skip to content
Mailwel
Email toolsAll email tools
Test and analyze
Decode and encode
DNS and authentication
Servers and reputation
Network toolsAll network tools
IPv4
IPv6
IPv4 and IPv6
Lookups
Bandwidth
Time toolsAll time tools
Converters
Time zones
Calculators
Theme

MTU and MSS calculator

Add the layers your traffic passes through, such as PPPoE, a VLAN or a VPN tunnel, to see the MTU left inside and the TCP MSS to use.

The largest IP packet the physical link carries: 1500 on most Ethernet and internet links, often 9000 with jumbo frames.

Layers, outermost first
  1. WireGuard over IPv6 40 IPv6 + 8 UDP + 32 WireGuard (16 header + 16 auth tag)80 bytes
Traffic inside the tunnel

Used in the commands below.

Try:

Result

1500-byte link, 1 layer

Example: WireGuard over IPv6. Add your own layers above.

MTU inside1420 bytes80 bytes of overhead
TCP MSS, IPv41380 bytes
TCP MSS, IPv61360 bytes
Data per packet with TCP timestamps
1368 (IPv4), 1348 (IPv6) bytes

Layer by layer

LayerBytesMTU after
Link1500
WireGuard over IPv6801420
  • Layer
    Link
    Bytes
    MTU after
    1500
  • Layer
    WireGuard over IPv6
    Bytes
    80
    MTU after
    1420

Commands

Set the MTU on the innermost interface (run as root):

ip link set dev eth0 mtu 1420

On a router or VPN gateway, clamp the MSS of TCP connections forwarded out of eth0, using iptables:

iptables -t mangle -A FORWARD -o eth0 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1380
ip6tables -t mangle -A FORWARD -o eth0 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1360

or nftables (this assumes an inet table called filter with a forward chain):

nft add rule inet filter forward oifname "eth0" meta nfproto ipv4 tcp flags syn tcp option maxseg size set 1380
nft add rule inet filter forward oifname "eth0" meta nfproto ipv6 tcp flags syn tcp option maxseg size set 1360

To follow the route's MTU instead of a fixed number, use --clamp-mss-to-pmtu in place of --set-mss (iptables) or size set rt mtu (nftables). Connections made by the machine itself pick their MSS from the interface MTU, so they don't need clamping.

How it works

The MTU (maximum transmission unit) is the largest IP packet a link carries in one piece. Every tunnel or extra header takes some of it. WireGuard over IPv6 adds 80 bytes, so a 1500-byte link leaves 1420 bytes for the packets inside.

If a packet is too big, it gets split into fragments or dropped. Path MTU discovery should find the right size, but firewalls often block the ICMP messages it relies on. Then small requests work while big downloads hang. Setting the right MTU on the tunnel interface prevents that.

The TCP MSS (maximum segment size) is the data in one TCP packet: the MTU minus 20 bytes of TCP header and 20 bytes of IPv4 header, or 40 of IPv6. Options such as timestamps take 12 more bytes from each packet. A router clamps the MSS (rewrites it when connections open) so devices behind it never send packets that are too big.

A VLAN tag works differently. It adds 4 bytes to the Ethernet frame, not to the IP packet, so the IP MTU stays the same. A tagged 1500-byte packet makes a 1522-byte frame, and switches on the path must accept it. Switches that support VLANs do. The IPsec figure is approximate: padding and the cipher change its size, so this uses the larger end.

To see how much data a link moves in a given time, use the transfer time calculator. For TCP windows on long links, use the bandwidth-delay product calculator.