Calcolatore Overhead MTU e MSS - IPsec, GRE, VXLAN, WireGuard
← Back to Main Calculator

MTU & MSS Overhead Calculator

Calculate exact TCP MSS, total encapsulation overhead, and required parent interface MTU for IPsec, GRE, VXLAN, WireGuard, and other tunnel protocols.

Base Configuration

Quick Scenario Presets

Total Overhead (L3+)
64 B
IPv4 + TCP
Optimal TCP MSS
1436 B
1500 − 64 = 1436 B
Max L4 Payload
1436 B
TCP data payload per segment
Required Parent Interface MTU
1564 B
To carry 1500 B payload without fragmentation

Interactive Packet Structure

Each block represents a protocol layer. Width is proportional to byte overhead.

Configuration Snippets

Use these commands to enforce TCP MSS clamping or adjust interface MTU on your network devices.

Understanding MTU, MSS, and Tunnel Overhead

What is the Difference Between MTU and MSS?

MTU (Maximum Transmission Unit) is a Layer 3 concept — the largest IP packet that can traverse a network link without fragmentation. Standard Ethernet MTU is 1500 bytes, but PPPoE links use 1492, and jumbo frames support up to 9000 bytes. MSS (Maximum Segment Size) is a Layer 4 TCP concept — the maximum TCP payload (data) in a single segment. MSS is negotiated during the TCP three-way handshake and is typically calculated as MSS = MTU - IP Header - TCP Header.

When tunnel encapsulation is involved, additional headers (GRE, IPsec, VXLAN, WireGuard) reduce the available space for TCP data. The MSS must be clamped to a lower value to prevent IP fragmentation. Use this MTU MSS overhead calculator to determine the exact MSS for any combination of tunnel protocols.

Why Do VPNs Cause Web Pages to Load Slowly?

VPNs and tunnels add encapsulation headers that increase packet size beyond the physical interface MTU. For example, a 1500-byte TCP packet going through an IPsec tunnel with 50 bytes of overhead becomes 1550 bytes — too large for the Ethernet link. The router either fragments the packet (which hurts performance and is often blocked by firewalls) or sends an ICMP "Fragmentation Needed" message back to the sender. However, many firewalls and middleboxes silently drop ICMP messages (a phenomenon called ICMP black hole or PMTUD failure), causing the sender to never learn about the smaller MTU. The result: TCP retransmits endlessly, web pages hang, and connections time out.

TCP MSS clamping solves this by rewriting the MSS value in TCP SYN packets so that the sender never generates segments larger than the tunnel can carry. This calculator helps you determine the correct MSS clamp value for your specific tunnel stack.

Reference Table: Protocol Overhead by Byte

Protocol / HeaderOverhead (Bytes)Notes
Ethernet (Standard)14MAC dst + src + EtherType
Ethernet + 802.1Q VLAN18Adds 4-byte VLAN tag
Ethernet + QinQ22Double VLAN tagging
PPPoE8PPPoE session + PPP protocol
GRE (IPv4)24Standard GRE with key/seq
IPsec ESP (Tunnel)~50AES-GCM-128 + HMAC-SHA256 average
VXLAN50Outer Eth 14 + IP 20 + UDP 8 + VXLAN 8
WireGuard40Outer IP 20 + UDP 8 + WG 12
OpenVPN~68UDP mode + TLS + HMAC (typical)
L2TP / IPsec~80L2TP + UDP + IPsec ESP
Geneve / NVGRE58Outer Eth 14 + IP 20 + UDP 8 + Geneve 16
IPv420Standard IPv4 header (no options)
IPv640Standard IPv6 header (no extensions)
TCP20Standard TCP header (no options)
UDP8Standard UDP header

Strumenti correlati

CIDR CalculatorSubnet CalculatorIPv6 CalculatorBDP & TCP WindowTransfer TimeIOPS to BandwidthFiber Loss BudgetEUI-64 Calculator

Frequently Asked Questions

How do I calculate TCP MSS for an IPsec tunnel?

For an IPsec tunnel mode connection with 1500 MTU: Add IPv4 header (20 B) + TCP header (20 B) + IPsec ESP overhead (~50 B for AES-GCM-128). Total overhead = 90 B. Optimal MSS = 1500 - 90 = 1410 B. If using GRE over IPsec (DMVPN), add GRE (24 B) for total overhead of 114 B and MSS of 1386 B. Configure with ip tcp adjust-mss 1410 on the tunnel interface.

What is the standard MSS value for PPPoE connections?

Standard PPPoE connections use an MTU of 1492 bytes (1500 minus 8 bytes of PPPoE overhead). MSS for IPv4 over PPPoE = 1492 - 20 (IPv4) - 20 (TCP) = 1452 bytes. For IPv6 over PPPoE: 1492 - 40 (IPv6) - 20 (TCP) = 1432 bytes. Many home routers automatically clamp MSS to these values. If you experience issues with certain websites, verify with this calculator and apply iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1452.

What is the VXLAN MTU overhead in data centers?

VXLAN adds 50 bytes of overhead: Outer Ethernet (14 B) + Outer IPv4 (20 B) + UDP (8 B) + VXLAN header (8 B). For a standard 1500 MTU physical interface, the effective MTU for tenant VMs is 1500 - 50 = 1450 bytes. TCP MSS with IPv4 = 1450 - 20 - 20 = 1410 bytes. Data center operators commonly set the physical (underlay) MTU to 1600 bytes to avoid fragmentation: 1600 - 50 = 1550 bytes available for tenant frames, accommodating a full 1500-byte tenant MTU without MSS clamping on the virtual machines.

How does WireGuard handle MTU compared to OpenVPN?

WireGuard adds approximately 40 bytes of overhead (20 B outer IPv4 + 8 B UDP + 12 B WireGuard header) compared to OpenVPN's ~68 bytes. This lower overhead is a key advantage of WireGuard. For a standard 1500 MTU link: WireGuard MSS = 1500 - 20 (inner IPv4) - 20 (inner TCP) - 40 = 1420 B. OpenVPN MSS = 1500 - 20 - 20 - 68 = 1392 B. The 28-byte difference means WireGuard can carry slightly more payload per TCP segment, which can improve throughput on high-latency links. WireGuard tunnels default to an MTU of 1420 when the physical link is 1500.