MTU and MSS: Understanding Maximum Transmission Unit and Segment Size
Optimize your network packet sizes. Learn how MTU and MSS affect network performance, what causes fragmentation, how to find optimal values, and fix connectivity issues. Essential for troubleshooting network performance and avoiding packet loss problems.
Quick Overview
MTU (Layer 2/3)
Maximum Transmission Unit - the largest packet size (including headers) that can be transmitted on a network.
- •Standard Ethernet: 1500 bytes
- •Includes IP and protocol headers
- •Set at network interface level
- •Too large causes fragmentation
MSS (Layer 4)
Maximum Segment Size - the largest amount of TCP data (payload only) that can be sent in a single segment.
- •Standard: 1460 bytes (1500 - 40)
- •TCP payload size only
- •Negotiated during TCP handshake
- •Prevents fragmentation
Understanding MTU
MTU defines the maximum size of a complete packet, including all headers and payload. Think of it as the size limit for a shipping container - if your cargo doesn't fit, it must be broken into smaller pieces.
Packet Structure with 1500 Byte MTU
Ethernet
14 bytes
IP Header
20 bytes
TCP Header
20 bytes
Payload (Data)
1460 bytes
Total: 1514 bytes (14 Ethernet + 1500 MTU)
Note: MTU of 1500 means 1500 bytes for IP packet. Ethernet adds its own 14-byte header, making the total frame 1514 bytes (plus 4 bytes for FCS).
Common MTU Sizes
Ethernet (Standard)1500
PPPoE (DSL)1492
VPN (typical)1400-1450
Jumbo Frames9000
MTU Across Technologies
- •WiFi: Usually 1500 (same as Ethernet)
- •4G/5G: Varies by carrier (1358-1500)
- •IPv6: Minimum 1280 bytes required
- •Tunnels: Reduced due to encapsulation
Understanding MSS
MSS is specifically for TCP and represents the maximum amount of actual data that can be sent in one TCP segment. MSS = MTU - IP Header (20 bytes) - TCP Header (20 bytes).
MSS Calculation
MTU (Maximum Packet Size)1500 bytes
- IP Header20 bytes
- TCP Header20 bytes
= MSS (Maximum Data Size)1460 bytes
Important: Both sides of a TCP connection negotiate MSS during the three-way handshake. The smaller value is used to prevent fragmentation.
MSS in TCP Handshake
Client
MSS: 1460
SYN →
MSS=1460
Server
MSS: 1400
← SYN-ACK
MSS=1400
Agreed MSS: 1400 (lower value)
Packet Fragmentation
When a packet is too large for the network's MTU, it must be fragmented (broken into smaller pieces). Fragmentation causes performance issues and should be avoided.
How Fragmentation Works
Original Large Packet (2000 bytes)
[Data: 2000 bytes]
↓ Fragmented for MTU 1500 ↓
Fragmented Packets
Fragment 1: [IP Header + 1480 bytes data] = 1500 bytes
Fragment 2: [IP Header + 520 bytes data] = 540 bytes
Problem: All fragments must arrive for reassembly. If one fragment is lost, the entire packet must be retransmitted. This increases latency and reduces throughput.
Problems with Fragmentation
- ✗Increased CPU overhead on routers
- ✗Higher chance of packet loss
- ✗More bandwidth consumed
- ✗Firewall/security issues
- ✗Reassembly delays
Why Avoid Fragmentation
- ✓MSS prevents TCP fragmentation
- ✓Path MTU Discovery finds optimal size
- ✓MSS clamping fixes mismatches
- ✓Better performance overall
Path MTU Discovery (PMTUD)
Path MTU Discovery is a technique to find the largest MTU size that can be used without fragmentation along the entire path between source and destination.
How PMTUD Works
1
Sender sets Don't Fragment (DF) flag
Prevents routers from fragmenting the packet
2
Sends packet at full MTU size
Typically starts with 1500 bytes
3
Router with smaller MTU sends ICMP error
"Fragmentation Needed" message with MTU size
4
Sender reduces packet size and retries
Continues until no ICMP errors received
PMTUD Black Hole Problem
If firewalls block ICMP "Fragmentation Needed" messages, PMTUD fails. This causes connections to hang when sending large packets. Solution: Enable ICMP on firewalls or use MSS clamping.
MSS Clamping
MSS clamping is a technique where routers modify the MSS value in TCP SYN packets to prevent fragmentation. This is commonly used with PPPoE, VPNs, and tunnels.
MSS Clamping in Action
Without MSS Clamping (Problem)
Client sends SYN with MSS=1460→
PPPoE router (MTU 1492, needs MSS ≤ 1452)
Packets get fragmented! 💥
With MSS Clamping (Solution)
Client sends SYN with MSS=1460→
Router modifies: MSS=1460 → MSS=1452
Server receives MSS=1452 ✓
No fragmentation!
When to Use MSS Clamping
- •PPPoE connections (DSL)
- •VPN tunnels (adds overhead)
- •GRE/IPIP tunnels
- •MPLS networks
- •Any reduced MTU scenario
MSS Clamping Formula
Interface MTU: 1492 (PPPoE)
IP Header: -20 bytes
TCP Header: -20 bytes
MSS Clamp Value: 1452 bytes
Configure on router: MSS = MTU - 40
Testing and Finding Optimal MTU
You can test to find the optimal MTU for your connection using ping with specific packet sizes.
Windows MTU Test
# Test with 1472 bytes payload + 28 bytes headers = 1500 MTU
ping -f -l 1472 google.com
# -f = Don't Fragment flag
# -l = Packet size (data only)
Results interpretation:
- • Success: MTU is good at this size
- • "Packet needs to be fragmented": MTU too large, reduce size
- • Keep reducing by 8-10 bytes until it works
Mac/Linux MTU Test
# macOS
ping -D -s 1472 google.com
# Linux
ping -M do -s 1472 google.com
# -D/-M do = Don't Fragment
# -s = Packet size
Common MTU Test Sizes
| Ping Size | Actual MTU | Connection Type |
|---|---|---|
| 1472 | 1500 | Standard Ethernet |
| 1464 | 1492 | PPPoE (DSL) |
| 1422 | 1450 | VPN typical |
| 1372 | 1400 | Some tunnels |
Formula: MTU = Ping Size + 28 (20 IP header + 8 ICMP header)
Configuring MTU and MSS
Setting MTU on Different Platforms
Windows
# View current MTU
netsh interface ipv4 show interfaces
# Set MTU
netsh interface ipv4 set subinterface "Ethernet" mtu=1492 store=persistent
macOS
# View current MTU
ifconfig en0
# Set MTU (temporary)
sudo ifconfig en0 mtu 1492
Linux
# View current MTU
ip link show eth0
# Set MTU (temporary)
sudo ip link set eth0 mtu 1492
# Permanent (in /etc/network/interfaces)
iface eth0 inet dhcp
mtu 1492
Configuring MSS Clamping on Routers
Cisco IOS
interface GigabitEthernet0/0
ip tcp adjust-mss 1452
Linux iptables
iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1452
MikroTik RouterOS
/ip firewall mangle add chain=forward protocol=tcp tcp-flags=syn action=change-mss new-mss=1452
Jumbo Frames
Jumbo frames allow MTU sizes larger than 1500 bytes, typically 9000 bytes. Used in data centers and high-performance networks to reduce overhead and increase throughput.
Advantages
- ✓Higher throughput: Fewer packets for same data
- ✓Lower CPU usage: Less packet processing
- ✓Reduced overhead: Fewer headers
- ✓Better for bulk transfers: Storage, backups
Limitations
- ✗All devices must support: One incompatible device breaks it
- ✗Not for internet: Only internal networks
- ✗Switch/NIC support needed: Hardware must handle 9K frames
- ✗Error retransmission costly: Larger packets to resend
When to Use Jumbo Frames
Best for: iSCSI storage, NFS, server-to-server communication, data center backbone. NOT for: Internet-facing connections, mixed environments, WiFi networks.
Troubleshooting MTU/MSS Issues
Common Symptoms
Connection hangs with large transfers
Small packets work, large transfers fail or freeze.
Cause: MTU mismatch + PMTUD blocked. Solution: Reduce MTU or enable MSS clamping
Websites partially load
HTML loads but images/CSS fail to download.
Cause: Large packets fragmented and dropped. Solution: Lower MTU to 1400-1450
VPN connects but no traffic flows
VPN establishes but can't access resources.
Cause: VPN MTU too large. Solution: Set VPN MTU to 1400 or lower
Diagnostic Steps
- 1.Test current MTU: Use ping tests to find maximum working packet size
- 2.Check for ICMP blocking: Ensure ICMP "Fragmentation Needed" messages aren't blocked
- 3.Verify MSS values: Capture TCP handshake with Wireshark to see negotiated MSS
- 4.Enable MSS clamping: Configure on router if you control it
- 5.Reduce MTU manually: Set to 1400-1450 on problematic connections
Best Practices
1
Use Standard MTU When Possible
1500 bytes works everywhere. Only change if you have specific issues or requirements.
2
Enable MSS Clamping on Edge Routers
Especially important for PPPoE, VPN, or any connection with reduced MTU.
3
Don't Block ICMP
Allow ICMP Type 3 Code 4 (Fragmentation Needed) for PMTUD to work properly.
4
Test Before Deploying Jumbo Frames
Ensure ALL network devices support 9K frames before enabling. One incompatible device breaks everything.
5
Document Your MTU Settings
Keep records of which networks use non-standard MTU values and why.