Calculate effective MTU, the TCP MSS clamp and fragmentation for IPsec, GRE, VXLAN, WireGuard, OpenVPN and PPPoE. Includes config examples.
Tunnels and overlays wrap each packet in extra headers, which leaves less room for your data. If the wrapped packet is larger than the link MTU, it is fragmented or dropped, and connections stall or crawl. This calculator subtracts the overhead of your encapsulation from the underlying MTU to give the effective MTU, then derives the TCP maximum segment size (MSS) to clamp so packets fit.
Presets cover IPsec ESP in tunnel and transport mode, GRE, VXLAN, WireGuard, OpenVPN over UDP and TCP, PPPoE and MPLS, for IPv4 and IPv6 where they differ. For example, WireGuard over a 1500-byte link leaves an effective MTU of 1440 and an IPv4 MSS of 1400. Enter a payload size to see whether it fragments and into how many pieces. For IPv6, which does not fragment in transit, the tool tells you the packet is too big instead.
The tool also gives ready-to-paste examples: a Cisco MSS adjustment, an iptables TCPMSS rule and a Linux interface MTU command. Overhead figures are typical values. Padding, NAT traversal and provider-specific options can add to them, so confirm the result with a ping test that sets the don't-fragment flag.
Every tunnel or overlay wraps your packet in extra headers. The wrapped packet still has to fit in the link MTU, usually 1500 bytes on Ethernet, so the room left for your own data shrinks by the size of those headers.
The presets use typical overhead figures. IPsec ESP in tunnel mode over IPv4 takes 74 bytes, leaving an effective MTU of 1426 and a TCP MSS of 1386. WireGuard takes 60 bytes, leaving 1440 and an MSS of 1400. VXLAN over IPv4 takes 50 bytes, GRE over IPv4 takes 24, and PPPoE takes 8. Real overhead can be higher with padding, NAT traversal and provider options.
The MTU is the largest packet a link carries. The MSS is the largest TCP payload in one packet, which is the MTU minus 40 bytes of IPv4 and TCP headers, or 60 bytes for IPv6.
When a packet is too big, IPv4 routers may fragment it, which is slow, or drop it if the don't-fragment bit is set. IPv6 routers never fragment: they drop the packet and send back an ICMPv6 Packet Too Big message. If a firewall blocks those messages, large packets vanish silently while small ones still work. The classic symptom is a connection that opens, then hangs when real data starts, even though ping works.
Clamp the MSS on the tunnel endpoint so TCP connections never build packets that are too large. Alternatively, lower the MTU on the tunnel interface so every protocol sees the smaller size. The calculator gives ready-to-paste examples: a Cisco adjust-mss command, an iptables TCPMSS rule and a Linux interface MTU command. Clamping fixes TCP only, while a lower interface MTU also covers UDP and other traffic.
Subtract the tunnel's overhead from the MTU of the underlying link. The presets in this calculator give typical overhead for IPsec, GRE, VXLAN, WireGuard, OpenVPN and PPPoE, and the result is the effective MTU to configure or to clamp against.
The MTU is the largest packet a link can carry, including headers. The MSS is the largest amount of TCP data in a single packet. For IPv4 the MSS is the MTU minus 40 bytes, and for IPv6 it is the MTU minus 60 bytes.
Small packets fit in the tunnel, but large ones do not. If path MTU discovery is blocked, the oversized packets are dropped without any warning to the sender, so the connection stalls once real data flows. Lowering the MTU or clamping the MSS usually fixes it.
Clamping the MSS affects TCP only and is the common fix on tunnel endpoints. Lowering the interface MTU applies to all traffic, including UDP, so use it when non-TCP traffic is also being dropped or fragmented.
Only the sending host may fragment IPv6 packets. Routers do not fragment them. A router that cannot forward a packet drops it and sends an ICMPv6 Packet Too Big message, so IPv6 depends on that message getting through.
Send pings that must not fragment. On Windows use ping -f -l 1472 followed by the host. On Linux use ping -M do -s 1472. On macOS use ping -D -s 1472. The payload is the MTU minus 28 bytes for the IPv4 and ICMP headers. Lower the size until the pings succeed.
Calculate optimal TCP window sizes, bandwidth-delay product, and buffer settings. Generate OS-specific tuning commands to maximize throughput on high-latency links.
Find the fastest a single TCP connection can run on your link, given round-trip time, packet loss, MTU and an optional receive window.
Calculate IPv4/IPv6 subnets instantly. Get network ranges, subnet masks, usable hosts & CIDR notation. Free professional tool - no registration needed.
Build and test firewall rulesets with an interactive rule editor. Craft test packets to trace through rules, toggle stateless vs stateful inspection, view connection state tables, and analyze rule match statistics. Includes pre-built rulesets for web servers, DMZ, and corporate LAN.