MTU & MSS Calculator
Stack the encapsulation your path actually uses and get the effective MTU, the TCP MSS both endpoints should negotiate, and the interface commands to enforce them.
ip mtu 1500
ip tcp adjust-mss 1460MTU problems are hard to learn from because they are invisible until they are not. In the lab you can build the tunnel, set an MTU that is too small, and watch exactly which packets survive and which do not.
Open the labWhy MTU bugs are so hard to spot
An MTU mismatch does not look like a network fault. Ping works. DNS works. SSH connects and stays responsive while you type. Then a file copy stalls at a few kilobytes, a web page loads its HTML but hangs on a large image, or a VPN carries everything except one application. Everything small succeeds; everything large disappears.
The mechanism is Path MTU Discovery. A sender marks its packets Don't Fragment and expects any router that cannot forward one to reply with an ICMP fragmentation needed message carrying the size that would fit. That feedback is the entire mechanism — and it is ICMP, which an overzealous firewall somewhere in the path has very likely blocked. When the message never arrives, the sender keeps retransmitting a packet that can never get through.
This is why ip tcp adjust-mss on a tunnel interface is the standard fix rather than a workaround. Clamping the MSS during the handshake means both endpoints agree on a safe segment size up front, so nothing ever depends on an ICMP message surviving a path you do not control.
MTU and MSS FAQ
What is the difference between MTU and MSS?
MTU is the largest IP packet an interface will send, headers included. MSS is the largest chunk of application data inside a TCP segment, headers excluded. On plain Ethernet, MTU 1500 minus a 20-byte IP header and a 20-byte TCP header gives MSS 1460.
Why do tunnels break large transfers but not ping?
Because small packets fit and large ones do not. A ping and a TCP handshake are tiny, so the tunnel carries them fine and the connection looks healthy. The first full-size data segment exceeds the tunnel's reduced MTU, and if the ICMP 'fragmentation needed' message that should fix it is filtered, the sender never learns — so the transfer just hangs. This is the classic Path MTU Discovery black hole.
What is ip tcp adjust-mss and when do I need it?
It rewrites the MSS value in TCP SYN packets crossing an interface, forcing both endpoints to agree on a smaller segment size. Use it on tunnel interfaces, where it is the reliable fix precisely because it does not depend on ICMP surviving the path.
How much overhead does GRE over IPsec add?
GRE adds 24 bytes — a 4-byte GRE header plus a 20-byte outer IPv4 header. IPsec ESP in tunnel mode adds up to about 73 more depending on cipher and padding. Together that is roughly 97 bytes off a 1500-byte link, leaving about 1403 for the inner packet, which is why 1400 is such a common tunnel MTU.
Why do VXLAN fabrics need jumbo frames?
VXLAN adds 50 bytes of outer Ethernet, IP, UDP, and VXLAN headers. If the underlay runs a standard 1500-byte MTU, tenant workloads are silently capped at 1450 and anything assuming 1500 will fragment or fail. Raising the underlay to 1600 or higher lets tenants keep a full 1500-byte MTU.
More free tools: Subnet Calculator · Port Number Lookup · OSI Model Chart · All tools