Home / Tools / MTU & TCP MSS Clamping Calculator

MTU & TCP MSS Clamping Calculator (PPPoE, WireGuard & 5G)

Compute exact interface MTU, IPv4/IPv6 TCP MSS clamping values, and copy-ready ping -f / nftables / RouterOS commands for PPPoE fiber, WireGuard, OpenVPN, IPsec, VXLAN, and 5G cellular links.

WAN Connection PresetUnderlying WAN / Link MTU (Bytes)

VPN / Tunnel Encapsulation OverlayInner Payload Protocol Stack

Select your WAN link type and tunnel protocol above, then click Calculate Path MTU, MSS & Ping Payload.

How Path MTU, TCP MSS, and DF Ping Probes Relate

An Ethernet switch or router interface measures packet size from the start of the Layer 3 IP header to the end of the TCP/UDP payload using the Maximum Transmission Unit (MTU). By contrast, during the TCP three-way handshake (SYN / SYN-ACK), each endpoint advertises its Maximum Segment Size (MSS)—the largest chunk of pure application data inside one segment before IP and TCP headers are prepended:

IPv4 TCP MSS Formula: MSS = Path MTU - 40 bytes (20-byte IPv4 header + 20-byte TCP header). Standard 1500 MTU yields 1460 MSS; PPPoE 1492 MTU yields 1452 MSS.
IPv6 TCP MSS Formula: MSS = Path MTU - 60 bytes (40-byte fixed IPv6 header + 20-byte TCP header). Standard 1500 MTU yields 1440 IPv6 MSS.
ICMP DF Ping Test Conversion: When probing with Don’t Fragment (ping -f -l on Windows or ping -M do -s on Linux), you specify only the ICMP payload, so subtract 28 bytes for IPv4 (20B IP + 8B ICMP) or 48 bytes for IPv6 (40B IPv6 + 8B ICMPv6). On a healthy 1500-byte Ethernet link, 1472 is the maximum passing IPv4 ping payload.

Encapsulation Overhead & Recommended Clamp Reference Table

Link / Tunnel Stack	Encapsulation Overhead	Safe Path MTU	IPv4 TCP MSS	IPv6 TCP MSS	Max IPv4 Ping (`-f -l`)
Standard Cable / Fiber (IPoE)	0 bytes (14B L2 Eth)	`1500`	`1460`	`1440`	`1472`
PPPoE Fiber (CenturyLink / DSL)	8 bytes (PPPoE + PPP)	`1492`	`1452`	`1432`	`1464`
WireGuard over 1500 WAN (Dual-Stack)	80 bytes (conservative)	`1420`	`1380`	`1360`	`1392`
WireGuard over 1492 PPPoE	88 bytes total	`1412`	`1372`	`1352`	`1384`
WireGuard over 5G Home (1420 WAN)	80 bytes over 464XLAT	`1340`	`1300`	`1280`	`1312`
OpenVPN UDP (AES-GCM)	~73 bytes (tune 1500 tunnel)	`1427`	`1387`	`1367`	`1399`

Why Path MTU Discovery Fails on the Modern Internet

Misconfigured intermediate firewalls frequently drop ICMP Type 3 Code 4 (Fragmentation Needed) or ICMPv6 Type 2 (Packet Too Big) messages silently. When that happens, small DNS queries and initial TLS ClientHello messages succeed, while large HTTPS file transfers or SSH directory listings hang indefinitely — a symptom known as a PMTU Blackhole. Configuring automatic TCP MSS clamping on your gateway rewrites outbound and inbound SYN headers dynamically so oversized packets never enter the bottleneck tunnel.