Elysia Tools

Browse tools, examples, visual explainers, and topic guides from one clear workspace.

Top Categories

Hubs

Language
ZHESPTRUFRDEEN

Elysia Tools

Navigation

Network

MTU / MSS Path Calculator

· Last updated：2026-07-08

Calculate how much each tunnel or encapsulation layer consumes from your interface MTU, the effective TCP MSS, and the DF ping probe size. For SRE, SD-WAN, and k8s CNI engineers.

Details

What this tool helps you do

Calculate exactly how much each tunnel or encapsulation layer eats out of your MTU — and what MSS your TCP sessions actually end up with.

Why this matters. A standard Ethernet MTU is 1500 bytes. Once you stack tunnels (GRE, VXLAN, WireGuard, IPSec) on top, each layer steals header bytes. The TCP inside thinks it has 1460 bytes of MSS, but the outer frame is now bigger than the path MTU — packets get fragmented, or silently dropped if DF is set. Path-MTU black holes are one of the most common causes of "weird, intermittent" connectivity on SD-WAN, k8s CNI overlays, and IPSec VPNs.

How it works. Start from the interface MTU (the outermost frame's payload budget). Subtract each encapsulation layer's overhead in order, outermost first. What's left after all layers is the MTU available to the inner IP packet. Subtract the IP header (20 bytes for IPv4, 40 for IPv6) and the TCP header (20 bytes default) to get the effective MSS.

Overhead table used (per layer, from RFCs):

  • Ethernet header is not counted — MTU already refers to the L3 payload.
  • VLAN 802.1Q — 4 bytes (adds a tag between SA and EtherType).
  • Q-in-Q — 8 bytes (two VLAN tags).
  • PPPoE — 8 bytes (6-byte PPPoE header + 2-byte PPP protocol).
  • GRE — 4 bytes minimum; +4 if the Checksum/Key/Sequence options are present.
  • VXLAN — 8 bytes (VXLAN header; outer UDP + outer IP counted separately by your encapsulating host — included here as part of the overlay budget if you're inside the tunnel).
  • Geneve — 8 bytes base (variable TLVs not included).
  • WireGuard — 80 bytes over IPv4 (32 outer IP + 8 outer UDP + 32 WG data msg + 8 poly1305 tag) or 100 over IPv6 (60 outer IP + 8 outer UDP + 32 WG data msg). Wider variants exist; this uses the common Noise_IK transport.
  • IPSec ESP — depends on cipher + auth + trailer. AES-GCM in transport mode ≈ 55 bytes (SPI 4 + Seq 4 + IV 8 + ciphertext padding + 16-byte ICV + 2 trailer); tunnel mode ≈ +20 for the new outer IP header.

Diagnostic output. For each stack the tool reports:

  • the per-layer overhead and the running total;
  • the remaining MTU after encapsulation;
  • the effective MSS after IP + TCP headers;
  • the exact DF probe size to use with ping -M do -s <size> (Linux) or ping -f -l <size> (Windows) to find the path MTU without fragmentation;
  • a warning if the effective MSS drops below 1360 (small enough to cause TCP performance issues or PMTUD failures).

Tips.

  • WireGuard users: set the WireGuard interface MTU to outer MTU − 80 (IPv4) or − 100 (IPv6) to avoid double fragmentation.
  • VXLAN in a datacenter with 1500-byte underlay: set the overlay MTU to 1450 (1500 − 50 for VXLAN + outer UDP + outer IP) to leave headroom.
  • PPPoE DSL: ping -M do -s 1472 on the WAN side tells you the true path MTU before PPPoE steals 8 more.

Execution

Run this tool

Fill in the form, run the tool, and review the result in one place.

Samples

Examples that match this tool

Related

Continue with connected tools and hubs

Written by the Elysia Tools team
Size88

Tool usage guide

Learn when to use this tool, what it supports, and how real users apply it.

Key facts

Category
Network
Input types
number, text, select
Output type
html
Sample coverage
4
API ready
Yes

Overview

The MTU / MSS Path Calculator helps network engineers, SREs, and Kubernetes administrators determine the exact overhead consumed by stacked encapsulation layers. By analyzing tunnels like GRE, VXLAN, WireGuard, IPSec, and PPPoE, the tool calculates the remaining MTU, the effective TCP MSS, and the precise payload size needed for Don't Fragment (DF) ping diagnostics to prevent packet loss and path MTU black holes.

When to use

  • When troubleshooting intermittent connectivity, packet drops, or slow transfer speeds across VPNs and SD-WAN tunnels.
  • When configuring virtual network interfaces, such as WireGuard or VXLAN overlays, and needing to set the correct MTU to avoid double fragmentation.
  • When calculating the exact payload size for ping sweeps to locate the bottleneck link MTU along a network path.

How it works

  1. 1Enter your physical or outer interface MTU, which defaults to 1500 bytes for standard Ethernet.
  2. 2Specify your encapsulation stack from outermost to innermost layer using comma-separated values like vlan, pppoe, vxlan, or wireguard4.
  3. 3Select the inner IP version (IPv4 or IPv6) and adjust the TCP transport header size if options are present.
  4. 4Review the calculated per-layer overhead, the remaining MTU, the effective TCP MSS, and the recommended DF ping probe size.

Use cases

  • Configuring MSS clamping on WAN routers to prevent fragmentation over PPPoE broadband connections.
  • Designing Kubernetes CNI overlay networks using VXLAN or Geneve to ensure pods use the optimal MTU.
  • Deploying multi-layered tunnels, such as IPSec VPNs inside GRE tunnels, without causing packet drops.

Examples

1. PPPoE DSL Link Optimization

Network Administrator

Background

A branch office connects to the corporate network via a PPPoE DSL connection. Users report that certain websites fail to load and large file transfers stall.

Problem

Determine the correct MTU and TCP MSS to configure on the WAN interface to prevent packet fragmentation over PPPoE.

How to use

Set the Interface MTU to 1500, enter 'pppoe' in the encapsulation stack, select IPv4 as the inner IP version, and keep the TCP header at 20 bytes.

Interface MTU: 1500, Encapsulation stack: pppoe, Inner IP: ipv4, TCP Header: 20

Outcome

The calculator shows that PPPoE consumes 8 bytes, leaving a remaining MTU of 1492 bytes, an effective TCP MSS of 1452 bytes, and a recommended DF ping probe size of 1464 bytes.

2. Kubernetes CNI Overlay MTU Tuning

DevOps Engineer

Background

A Kubernetes cluster is deployed with a VXLAN overlay network running over a standard 1500-byte physical network infrastructure.

Problem

Calculate the maximum safe MTU for the pod network interfaces to prevent outer packet fragmentation.

How to use

FAQ

What is a Path MTU (PMTU) black hole?

It occurs when a packet exceeds a link's MTU with the Don't Fragment (DF) flag set, and a router drops it without sending the required ICMP 'Destination Unreachable' message back to the sender.

Why does WireGuard have an 80-byte overhead on IPv4?

This overhead accounts for the 32-byte outer IP header, 8-byte outer UDP header, 32-byte WireGuard data message header, and 8-byte Poly1305 authentication tag.

How do I use the calculated DF probe size to test my network?

Run a ping command with the DF flag set and the calculated size: `ping -M do -s <size> <IP>` on Linux, or `ping -f -l <size> <IP>` on Windows.

What happens if the effective TCP MSS drops below 1360 bytes?

An MSS below 1360 bytes can trigger performance degradation, increased header overhead ratio, or compatibility issues with legacy network equipment.

Can I calculate overhead for custom or proprietary protocols?

Yes, you can use the custom overhead field to input any additional bytes consumed by protocols not natively listed in the encapsulation options.

Home
Tools3201
Samples593
Visualizations465
Viewers103
Hubs233
Tags333
Images, Audio & Video657

Image, audio, and video processing, conversion, and optimization tools

Math, Date & Finance644

Calculators, numerics, date logic, statistics, and finance tools

Design & Color297

Color, layout, graphics, visual styling, and design helper tools

Text & Writing209

Writing, cleanup, formatting, extraction, and text analysis tools

Developer & Web193

Developer utilities, networking, web debugging, and automation helpers

Conversion & Encoding175

Format, file, archive, unit, and encoding conversion tools

FLAC/WAV Source Screening and Evidence Handoff
Self-Hosted Giveaway Widget Review and Embed Handoff
Stripe Promo Code Batch Review and Import Preflight
Batch Photo Culling Review and Editing Shortlist Handoff
UI Screenshot Structure Review and Development Handoff

© 2026 Elysia Tools. All rights reserved.

DocsPricingAboutTerms of ServicePrivacy PolicyCookiesContact
File System

Path Analyzer Samples

Comprehensive collection of file system paths from Windows, Linux, and macOS for path analysis and testing

Python

Web Image Processing Python Samples

Web Python image processing examples using PIL/Pillow including reading, saving, resizing, and format conversion

Development

Import Path Examples

Collection of JavaScript and TypeScript import examples demonstrating various import patterns and module systems

Text Processing

Duplicate Line Samples

Sample files with various types of duplicate lines for testing duplicate removal tools

Health

Lotka–Volterra Predator-Prey Dynamics Simulator

RK4 simulation of the classic predator–prey oscillator with phase plane, closed orbits, equilibrium, and period analysis.

Games

2048 Game

Classic 2048. Arrow keys or swipe to slide and merge equal numbers. Each valid move spawns a tile; score accumulates from merges. 4×4 / 5×5 / 6×6 boards, pick a goal tile.

Media

Audio Filler Word Removal Map

Combine a timestamped transcript with the audio to mark filler words (um, uh, 嗯, 那个…) and optionally mute or remove them.

Media

Audio Metadata Compress

Compress or remove metadata and embedded artwork to reduce file size

Input 1500 as the interface MTU, enter 'vxlan' in the encapsulation stack, and select IPv4 for the inner payload.

Interface MTU: 1500, Encapsulation stack: vxlan, Inner IP: ipv4, TCP Header: 20

Outcome

The calculator determines that VXLAN consumes 50 bytes total (including outer IP and UDP headers), resulting in a remaining MTU of 1450 bytes and an effective TCP MSS of 1410 bytes for pod-to-pod traffic.