# MTU / MSS Path Calculator

Calculate how much each tunnel or encapsulation layer consumes from your interface MTU, the effective TCP MSS, and the DF ping probe size. For SRE, SD-WAN, and k8s CNI engineers.

> Canonical page: https://elysiatools.com/en/tools/mtu-and-mss-path-calculator

- **Category:** Network

- **Keywords:** mtu, mss, path mtu, pmtud, encapsulation, gre, vxlan, wireguard, ipsec, pppoe, vlan, fragmentation, tcp, sd-wan

## Overview

Calculate exactly how much each tunnel or encapsulation layer eats out of your MTU — and what MSS your TCP sessions actually end up with. \*\*Why this matters.\*\* A standard Ethernet MTU is 1500 bytes. Once you stack tunnels (GRE, VXLAN, WireGuard, IPSec) on top, each layer steals header bytes. The TCP inside thinks it has 1460 bytes of MSS, but the outer frame is now bigger than the path MTU — packets get fragmented, or silently dropped if DF is set. Path-MTU black holes are one of the most common causes of "weird, intermittent" connectivity on SD-WAN, k8s CNI overlays, and IPSec VPNs. \*\*How it works.\*\* Start from the interface MTU (the outermost frame's payload budget). Subtract each encapsulation layer's overhead in order, outermost first. What's left after all layers is the MTU available to the inner IP packet. Subtract the IP header (20 bytes for IPv4, 40 for IPv6) and the TCP header (20 bytes default) to get the \*\*effective MSS\*\*. \*\*Overhead table used (per layer, from RFCs)\*\*: - \*\*Ethernet header\*\* is not counted — MTU already refers to the L3 payload. - \*\*VLAN 802.1Q\*\* — 4 bytes (adds a tag between SA and EtherType). - \*\*Q-in-Q\*\* — 8 bytes (two VLAN tags). - \*\*PPPoE\*\* — 8 bytes (6-byte PPPoE header + 2-byte PPP protocol). - \*\*GRE\*\* — 4 bytes minimum; +4 if the Checksum/Key/Sequence options are present. - \*\*VXLAN\*\* — 8 bytes (VXLAN header; outer UDP + outer IP counted separately by your encapsulating host — included here as part of the overlay budget if you're inside the tunnel). - \*\*Geneve\*\* — 8 bytes base (variable TLVs not included). - \*\*WireGuard\*\* — 80 bytes over IPv4 (32 outer IP + 8 outer UDP + 32 WG data msg + 8 poly1305 tag) or 100 over IPv6 (60 outer IP + 8 outer UDP + 32 WG data msg). Wider variants exist; this uses the common Noise\_IK transport. - \*\*IPSec ESP\*\* — depends on cipher + auth + trailer. AES-GCM in \*\*transport\*\* mode ≈ 55 bytes (SPI 4 + Seq 4 + IV 8 + ciphertext padding + 16-byte ICV + 2 trailer); \*\*tunnel\*\* mode ≈ +20 for the new outer IP header. \*\*Diagnostic output.\*\* For each stack the tool reports: - the per-layer overhead and the running total; - the remaining MTU after encapsulation; - the effective MSS after IP + TCP headers; - the exact \*\*DF probe size\*\* to use with \`ping -M do -s \` (Linux) or \`ping -f -l \` (Windows) to find the path MTU without fragmentation; - a warning if the effective MSS drops below 1360 (small enough to cause TCP performance issues or PMTUD failures). \*\*Tips.\*\* - WireGuard users: set the WireGuard interface MTU to \`outer MTU − 80\` (IPv4) or \`− 100\` (IPv6) to avoid double fragmentation. - VXLAN in a datacenter with 1500-byte underlay: set the overlay MTU to 1450 (1500 − 50 for VXLAN + outer UDP + outer IP) to leave headroom. - PPPoE DSL: \`ping -M do -s 1472\` on the WAN side tells you the true path MTU before PPPoE steals 8 more.

## Inputs

- **Interface MTU (bytes)** (number): e.g. 1500
- **Encapsulation stack** (text): Comma-separated list of layers, outermost first. Valid values: vlan, qinq, pppoe, gre, gre_checksum, vxlan, geneve, wireguard4, wireguard6, ipsec_transport, ipsec_tunnel.
- **IP version of inner payload** (select)
- **TCP transport header (bytes)** (number): e.g. 20 (with TCP options up to 60)
- **Custom per-layer overhead (bytes)** (number): e.g. 0 (extra bytes not covered above)

## When to use

- When troubleshooting intermittent connectivity, packet drops, or slow transfer speeds across VPNs and SD-WAN tunnels.
- When configuring virtual network interfaces, such as WireGuard or VXLAN overlays, and needing to set the correct MTU to avoid double fragmentation.
- When calculating the exact payload size for ping sweeps to locate the bottleneck link MTU along a network path.

## How it works

- Enter your physical or outer interface MTU, which defaults to 1500 bytes for standard Ethernet.
- Specify your encapsulation stack from outermost to innermost layer using comma-separated values like vlan, pppoe, vxlan, or wireguard4.
- Select the inner IP version (IPv4 or IPv6) and adjust the TCP transport header size if options are present.
- Review the calculated per-layer overhead, the remaining MTU, the effective TCP MSS, and the recommended DF ping probe size.

## Use cases

- Configuring MSS clamping on WAN routers to prevent fragmentation over PPPoE broadband connections.
- Designing Kubernetes CNI overlay networks using VXLAN or Geneve to ensure pods use the optimal MTU.
- Deploying multi-layered tunnels, such as IPSec VPNs inside GRE tunnels, without causing packet drops.

## Frequently asked questions

### What is a Path MTU (PMTU) black hole?

It occurs when a packet exceeds a link's MTU with the Don't Fragment (DF) flag set, and a router drops it without sending the required ICMP 'Destination Unreachable' message back to the sender.

### Why does WireGuard have an 80-byte overhead on IPv4?

This overhead accounts for the 32-byte outer IP header, 8-byte outer UDP header, 32-byte WireGuard data message header, and 8-byte Poly1305 authentication tag.

### How do I use the calculated DF probe size to test my network?

Run a ping command with the DF flag set and the calculated size: \`ping -M do -s \` on Linux, or \`ping -f -l \` on Windows.

### What happens if the effective TCP MSS drops below 1360 bytes?

An MSS below 1360 bytes can trigger performance degradation, increased header overhead ratio, or compatibility issues with legacy network equipment.

### Can I calculate overhead for custom or proprietary protocols?

Yes, you can use the custom overhead field to input any additional bytes consumed by protocols not natively listed in the encapsulation options.

## Related tools

- [Lotka–Volterra Predator-Prey Dynamics Simulator](https://elysiatools.com/en/tools/lotka-volterra-predator-prey): RK4 simulation of the classic predator–prey oscillator with phase plane, closed orbits, equilibrium, and period analysis.
- [2048 Game](https://elysiatools.com/en/tools/2048-game): Classic 2048. Arrow keys or swipe to slide and merge equal numbers. Each valid move spawns a tile; score accumulates from merges. 4×4 / 5×5 / 6×6 boards, pick a goal tile.
- [Audio Filler Word Removal Map](https://elysiatools.com/en/tools/audio-filler-word-removal-map): Combine a timestamped transcript with the audio to mark filler words (um, uh, 嗯, 那个…) and optionally mute or remove them.
- [Audio Metadata Compress](https://elysiatools.com/en/tools/audio-metadata-compress): Compress or remove metadata and embedded artwork to reduce file size
- [Sub-Bass Mono Maker](https://elysiatools.com/en/tools/audio-sub-bass-mono-maker): Fold everything below your crossover to mono while keeping the stereo image above it — the elliptical-EQ move that protects vinyl cuts and mono-sub club systems.
- [Bulk Email Extractor](https://elysiatools.com/en/tools/bulk-email-extractor): Extract all email addresses from input text, articles, web source code, or mixed content. Supports deduplication and export to JSON.
- [CSV Transformer](https://elysiatools.com/en/tools/csv-transformer): Transform and process CSV data with column operations, calculations, and data type conversions. Supports renaming columns, adding calculated columns, removing columns, converting data types, calculating values, and filtering rows. Operation examples: • Rename column: \[{"type": "rename", "column": "old_name", "new_name": "new_name"}\] • Add calculated column: \[{"type": "add_column", "new_column": "total", "formula": "price * quantity"}\] • Remove column: \[{"type": "remove_column", "remove_column": "column_to_remove"}\] • Convert data type: \[{"type": "convert_type", "convert_column": "age", "target_type": "number"}\] • Calculate values: \[{"type": "calculate", "target_column": "total", "expression": "price * tax + shipping"}\] • Filter rows: \[{"type": "filter_values", "filter_column": "status", "operator": "equals", "value": "active"}\]
- [BOM Character Remover](https://elysiatools.com/en/tools/data-bom-remover): Remove BOM (Byte Order Mark) characters from text and file content. Perfect for cleaning up text files that have encoding issues, fixing CSV imports, and preparing data for processing. Features: - Detect and remove UTF-8 BOM (EF BB BF) - Detect and remove UTF-16 BOM (FE FF or FF FE) - Detect and remove UTF-32 BOM (00 00 FE FF or FF FE 00 00) - Support multiple input formats - Visual BOM character display - Detailed detection report - Support for batch text processing Common Use Cases: - Fix CSV file import errors - Clean up text file encoding issues - Prepare data for JSON parsing - Fix XML parsing problems - Resolve API data encoding conflicts - Standardize text data format

## Samples

- [Path Analyzer Samples](https://elysiatools.com/en/samples/path-analyzer): Comprehensive collection of file system paths from Windows, Linux, and macOS for path analysis and testing
- [Web Image Processing Python Samples](https://elysiatools.com/en/samples/web-image-processing-python): Web Python image processing examples using PIL/Pillow including reading, saving, resizing, and format conversion
- [Import Path Examples](https://elysiatools.com/en/samples/import-path-examples): Collection of JavaScript and TypeScript import examples demonstrating various import patterns and module systems
- [Duplicate Line Samples](https://elysiatools.com/en/samples/text-duplicate-line-samples): Sample files with various types of duplicate lines for testing duplicate removal tools