MTU & MSS Calculator

Start from your link's MTU, add the encapsulation in the path, and get the MTU and TCP MSS that fit without fragmenting.

  • Free
  • No Sign-Up
  • Runs in Your Browser
Encapsulation in the Path
Enter your link's MTU (1500 for normal Ethernet) and tick what the path adds.

How to Use

How to use the MTU & MSS Calculator

  1. 01

    Set the base MTU

    1500 for normal Ethernet, 9000 for jumbo frames.

  2. 02

    Add the layers

    Tick each encapsulation in the path: PPPoE, a VPN or an overlay like VXLAN.

  3. 03

    Use the numbers

    Set the inner interface's MTU, and clamp TCP MSS on the router to the value shown.

IP & Network

About the MTU & MSS Calculator

MTU, MSS and why they matter

The MTU is the largest packet an interface sends. Every tunnel adds headers, so the packet inside must be smaller. If it is not, packets are fragmented or, more often, silently dropped when ICMP is filtered. The symptom is familiar: ping works and small pages load, but large downloads, SSH sessions or TLS handshakes hang.

The MSS is the largest TCP payload, and is the MTU minus 40 bytes for IPv4 (20 IP + 20 TCP) or 60 for IPv6. Clamping MSS on the router fixes TCP even when path MTU discovery is broken.

LayerOverhead (bytes)
802.1Q VLAN tag4 (on the wire; MTU unchanged on most kit)
PPPoE8
GRE24
IP-in-IP20
VXLAN50
Geneve50+ (options extra)
WireGuard (IPv4)60
WireGuard (IPv6)80
IPsec ESP (tunnel, AES-GCM)about 73
OpenVPN (UDP)about 69

MTU in virtualisation

Proxmox SDN with VXLAN, Open vSwitch overlays and VPN-connected sites all need the VM's interface MTU lowered (to 1450 for VXLAN over 1500) or the underlay raised to 1550 or more. A mismatch shows up as VMs that can ping but cannot finish a large HTTPS download.

MTU by Tunnel

WireGuardVXLANPPPoEGREIP-in-IPIPsecOpenVPN802.1Q VLANJumbo Frames

What it can't tell you

  • IPsec and OpenVPN overhead varies with cipher and padding; the values are typical, so test with ping -M do -s <size>.

Frequently asked questions

What MTU should I use for WireGuard?
1420 is WireGuard's default and safe over IPv4 and IPv6 on a 1500 link. Over PPPoE (1492) use 1412.
What MSS should I clamp to on PPPoE?
1452 for IPv4 (1492 MTU minus 40).
How do I test the path MTU?
On Linux: ping -M do -s 1472 <host>. 1472 + 28 bytes of headers = 1500. Lower the size until replies come back; the largest that works plus 28 is the path MTU.

Free Tools

More tools

All Tools
Subnet CalculatorNetwork, broadcast, usable range and mask for any IPv4 or IPv6 CIDR.Bandwidth CalculatorConvert Mbps to TB per month, and time a transfer at any speed.Firewall Rule GeneratorGenerate iptables, nftables and UFW rules for common server set-ups.Proxmox Resource CalculatorHow many VMs fit on a Proxmox host, with overcommit and reserves.

Watch every VM interface

Frabs reads traffic on every guest interface, VXLAN and VLAN included, and stops abuse without touching your firewall.

Start Free TrialTry the Demo