How do I calculate MSS from MTU?

Subtract the IP header and the TCP header from the MTU: 1500 − 20 − 20 gives the familiar 1460 on plain Ethernet IPv4. Tunnel overhead and TCP options come off before that.

Why is my MTU 1492 instead of 1500?

PPPoE, used by most DSL and many fibre services, adds a 6-byte PPPoE header and a 2-byte PPP header. Those 8 bytes come out of the Ethernet payload, leaving 1492 for IP.

What MSS should I clamp to on a WireGuard tunnel?

WireGuard adds about 60 bytes over IPv4 and 80 over IPv6, so a 1500-byte link leaves roughly 1400 and 1360 respectively. Enter your real link MTU above rather than assuming 1500.

How do I find the path MTU with ping?

Send packets with fragmentation forbidden and shrink them until one gets through: ping -M do -s 1472 on Linux, ping -D -s 1472 on macOS, or ping -f -l 1472 on Windows. Add 28 bytes to the largest payload that succeeds.

What is the smallest MTU I can safely use?

IPv4 guarantees 576 bytes and IPv6 requires at least 1280. Going below the IPv6 minimum breaks the protocol rather than merely slowing it, so 1280 is the practical floor on any dual-stack link.

MTU & MSS Calculator

Work out the TCP MSS an MTU leaves you, allowing for IPv6, tunnels and TCP options.

The MTU & MSS Calculator runs entirely in your browser. It performs arithmetic only — no packets are sent and nothing you type leaves your device.

Open the CIDR Subnet Calculator

About MTU & MSS Calculator

Maximum segment size is whatever is left of the link MTU once the headers have taken their share: 20 bytes for IPv4 or 40 for IPv6, 20 more for TCP, plus another 12 when timestamps are negotiated, plus whatever a tunnel wraps around all of it. Getting the number wrong is rarely a clean failure. Packets that need fragmenting go missing when the ICMP messages that would say so are filtered, and the connection hangs part-way through a transfer instead of refusing to open — the classic MTU black hole. This calculator does the arithmetic for the common encapsulations, inverts it when you know the MSS but not the MTU, and turns a ping test into a measured path MTU.

Features

MSS from MTU for IPv4 and IPv6, with the header breakdown shown
Presets for PPPoE, GRE, IPsec, WireGuard, OpenVPN, VXLAN and L2TP
TCP timestamp option accounted for separately
Inverse mode: the MTU a known MSS implies
Path MTU from the largest ping payload that still gets through
The exact ping command to run on Linux, macOS and Windows
Frame size on the wire, including Ethernet framing overhead
Warnings when the result falls below the IPv4 or IPv6 minimum

How to use the MTU & MSS Calculator

Enter the MTU of the link — 1500 on plain Ethernet, 1492 behind PPPoE
Pick the IP version and any tunnel the traffic passes through
Read the MSS to clamp to, along with the header breakdown
Use ping mode to measure the real path MTU when you are not sure

Example

Input

MTU 1500 · IPv4 · WireGuard tunnel (60 bytes)

Output

Effective MTU 1440 · MSS 1400
Clamp MSS to 1400 on the tunnel interface

Every layer of encapsulation comes straight out of the payload, which is why tunnelled links need MSS clamping.

Common errors & troubleshooting

Small requests work but large uploads hang. — A textbook MTU black hole. Something on the path drops oversized packets without sending the ICMP message that would trigger path MTU discovery. Clamp MSS to the value shown here on the router or tunnel interface.
The MSS in a packet capture is 12 bytes lower than expected. — TCP timestamps are enabled, and their option bytes come out of every segment. Turn the timestamp toggle on here to match what the capture shows.
IPv6 works over the tunnel but IPv4 does not, or the reverse. — The IPv6 header is 40 bytes against IPv4's 20, so the two protocols get different MSS values from the same MTU. Calculate and clamp them separately.

Frequently asked questions

How do I calculate MSS from MTU?: Subtract the IP header and the TCP header from the MTU: 1500 − 20 − 20 gives the familiar 1460 on plain Ethernet IPv4. Tunnel overhead and TCP options come off before that.
Why is my MTU 1492 instead of 1500?: PPPoE, used by most DSL and many fibre services, adds a 6-byte PPPoE header and a 2-byte PPP header. Those 8 bytes come out of the Ethernet payload, leaving 1492 for IP.
What MSS should I clamp to on a WireGuard tunnel?: WireGuard adds about 60 bytes over IPv4 and 80 over IPv6, so a 1500-byte link leaves roughly 1400 and 1360 respectively. Enter your real link MTU above rather than assuming 1500.
How do I find the path MTU with ping?: Send packets with fragmentation forbidden and shrink them until one gets through: ping -M do -s 1472 on Linux, ping -D -s 1472 on macOS, or ping -f -l 1472 on Windows. Add 28 bytes to the largest payload that succeeds.
What is the smallest MTU I can safely use?: IPv4 guarantees 576 bytes and IPv6 requires at least 1280. Going below the IPv6 minimum breaks the protocol rather than merely slowing it, so 1280 is the practical floor on any dual-stack link.

Related tools

CIDR / Subnet Calculator — Calculate network, broadcast, host range and mask from a CIDR block.
IPv6 ↔ IPv4 Converter — Convert between IPv4 and IPv6 (mapped/expanded/compressed) and extract embedded IPv4.
Download Time Calculator — Estimate how long a file takes to transfer at a given connection speed.
Data Usage Calculator — Turn streaming, browsing and call habits into monthly gigabytes and cap forecasts.
Port Number Lookup — What runs on a TCP or UDP port — search by number or service name.
Reverse DNS Generator — Turn IPs and prefixes into PTR names, zone files and RFC 2317 delegations.