MTU and TCP MSS Clamping Calculator

Calculate optimal MTU sizes, TCP MSS clamping (IPv4/IPv6), and Don't Fragment ping payloads to resolve web page freezes over PPPoE and VPN tunnels.

Input Parameters

Try Example:

Calculation Results

linkType: pppoe
mtu: 1500
ipVersion: ipv4
ipHeaderBytes: 20
tcpHeaderBytes: 20
icmpHeaderBytes: 8
tcpMss: 1460
pingDfPayload: 1472
overheadBytes: 20
overheadDesc: PPPoE Standar ISP Fiber / DSL (8–20 Byte Header)
windowsPingCmd: ping 1.1.1.1 -f -l 1472
linuxPingCmd: ping -M do -s 1472 1.1.1.1
macosPingCmd: ping -D -s 1472 1.1.1.1

How to Use This Tool

Select your link type or VPN tunnel preset (Ethernet 1500, PPPoE 1480, WireGuard 1420, L2TP/IPSec 1400, or Custom).
Select your IP protocol version (IPv4 with 40-byte IP+TCP overhead or IPv6 with 60-byte overhead).
Inspect the optimal TCP MSS and execute the generated Don't Fragment (DF) ping command in your operating system terminal to verify MTU without fragmentation.

Worked Example: Fiber ISP PPPoE (MTU 1480 IPv4)

Computed example: A PPPOE connection (PPPoE Standar ISP Fiber / DSL (8–20 Byte Header)) has an MTU of 1480 bytes. Under IPV4 (20B IP + 20B TCP), optimal TCP MSS is 1440 bytes and DF ping payload size is 1452 bytes.

Example Input

{
  "linkType": "pppoe",
  "ipVersion": "ipv4"
}

Calculated Output

linkType:: pppoe
mtu:: 1480
ipVersion:: ipv4
ipHeaderBytes:: 20
tcpHeaderBytes:: 20
icmpHeaderBytes:: 8
tcpMss:: 1440
pingDfPayload:: 1452
overheadBytes:: 20
overheadDesc:: PPPoE Standar ISP Fiber / DSL (8–20 Byte Header)
windowsPingCmd:: ping 1.1.1.1 -f -l 1452
linuxPingCmd:: ping -M do -s 1452 1.1.1.1
macosPingCmd:: ping -D -s 1452 1.1.1.1

Core Concept & Engineering Notes

Maximum Transmission Unit (MTU) specifies the largest physical or logical packet payload in bytes that an interface can transmit onto a network path without requiring IP packet fragmentation. While traditional Ethernet networks standardize on an MTU of 1500 bytes, traversing encapsulation tunnels—such as fiber PPPoE, WireGuard, L2TP/IPSec, GRE, or cellular 4G/5G LTE GTP tunnels—appends supplementary outer headers that consume payload space, lowering the effective transit MTU to 1480, 1420, or 1400 bytes. The most notorious operational issue caused by an MTU mismatch is the Path MTU Discovery (PMTUD) Black Hole. During the initial TCP three-way handshake, endpoints exchange their Maximum Segment Size (MSS) based on their local interface MTU (typically 1460 bytes for Ethernet). If a middlebox or VPN gateway along the path cannot accommodate a 1500-byte frame, it drops packets with the Don't Fragment (DF) bit set and generates an ICMP 'Fragmentation Needed' (Type 3, Code 4) notification. If misconfigured upstream firewalls block ICMP, the sender retransmits endlessly, freezing file downloads and TLS negotiations while ping tests paradoxically succeed. The industry-standard remediation is TCP MSS Clamping. An edge gateway inspects incoming and outgoing SYN packets and clamps the negotiated MSS down to match the tunnel path (MTU minus 40 bytes for IPv4 or minus 60 bytes for IPv6). This calculator computes exact MSS thresholds across standard carrier and tunnel presets and generates diagnostic Don't Fragment ping commands for Windows, Linux, and macOS to verify maximum unfragmented transmission units directly on live connections.

How It Was Calculated (Formulas & Steps)

Mathematical Formulas

TCP MSS (IPv4) = MTU − (20B IP Header + 20B TCP Header) = MTU − 40
TCP MSS (IPv6) = MTU − (40B IP Header + 20B TCP Header) = MTU − 60
Ping Don't Fragment Payload (IPv4) = MTU − (20B IP + 8B ICMP) = MTU − 28
Ping Don't Fragment Payload (IPv6) = MTU − (40B IP + 8B ICMP) = MTU − 48
Windows Test: ping 1.1.1.1 -f -l <Payload>

Step-by-Step Calculation

Selected link preset: PPPOE → Interface MTU = 1500 bytes
IPV4 protocol overhead: IP Header = 20 bytes, TCP Header = 20 bytes (Total = 40 bytes)
Optimal TCP MSS = MTU (1500) − (20 + 20) = 1460 bytes
Don't Fragment (DF) Ping Buffer Size = MTU (1500) − (20 + 8) = 1472 bytes

Frequently Asked Questions (FAQ)

Why does a normal ping succeed while loading certain web pages freezes or times out?

Standard ICMP echo requests only carry 32 or 64 bytes of payload and easily fit within any link MTU. Full web pages, however, push maximum-sized 1500-byte TCP packets. If intermediate tunnel MTUs are smaller and MSS is unclamped, these packets get dropped silently (PMTUD Black Hole).

How do I discover the exact maximum unfragmented MTU using Ping?

On Windows, execute `ping 1.1.1.1 -f -l 1472`. If you see 'Packet needs to be fragmented', decrement the value (e.g. 1452). Your link MTU is the largest successful payload plus 28 bytes (20 bytes IP + 8 bytes ICMP).

Why is the TCP MSS for IPv6 20 bytes smaller than IPv4?

The standard IPv4 base header is 20 bytes, whereas the IPv6 base header is 40 bytes. With TCP headers adding 20 bytes in both protocols, total header overhead in IPv6 is 60 bytes (MTU − 60), reducing MSS by 20 bytes compared to IPv4.

MikroTik WireGuard VPN MTU & MSS Calculator

Deploy site-to-site WireGuard VPN on RouterOS v7 with automatic TCP MSS Clamping to prevent tunnel web page freezes and PMTUD black holes.

IPv4 Subnet and CIDR Calculator

Calculate IPv4 network address, broadcast, usable host range, netmask, wildcard, binary mask, and RFC address type (RFC 1918, /31, CGNAT).

MikroTik Bandwidth Calculator (Simple Queue, Burst, PCQ, FQ-CoDel)

Calculate Limit-At (CIR), Max-Limit (MIR), Burst, PCQ, and FQ-CoDel for RouterOS v7 with automated configuration script generation.

References & Notes

Last updated: 2026-11-06Content Status: Draft (Pending Editorial Review)

Note: Results above are mathematical estimates based on standard formulas. Always verify against official vendor documentation and site conditions before production deployment.