MSS Calculator
Compute TCP Maximum Segment Size from MTU for IPv4/IPv6, including TCP options overhead.
Inputs
e.g. timestamps (10B) + SACK-permitted, padded to 4-byte alignment; 20B is a common total with timestamps
MSS — Base (bytes)
1,460
MSS — With TCP Options (bytes)
1,440
Base Header Overhead (bytes)
40
Step by step
Values used
MTU (bytes) = 1,500; IP Version = IPv4 (20-byte header); TCP Options Size (bytes) = 20
Maximum Segment Size
MSS = MTU − 40 (IPv4) or MTU − 60 (IPv6); MSS_effective = MSS − TCP_options_bytes
MSS — Base (bytes)
= 1,460
MSS — With TCP Options (bytes)
= 1,440
Base Header Overhead (bytes)
= 40
How it works
TCP's Maximum Segment Size is the largest chunk of application data a single TCP segment can carry, derived by subtracting IP and TCP header overhead from the path MTU — 20 bytes of IPv4 header plus 20 bytes of base TCP header (40 total), or 40 bytes of IPv6 header plus 20 bytes of TCP header (60 total). Real connections often carry TCP options (timestamps, SACK-permitted, window scale) that consume additional bytes within the TCP header space beyond the base 20, further reducing the usable MSS below the theoretical MTU-minus-40/60 figure.
Formula
Maximum Segment Size
MSS = MTU − 40 (IPv4) or MTU − 60 (IPv6); MSS_effective = MSS − TCP_options_bytes
- H_{ip}
- 20 (IPv4) or 40 (IPv6) bytes
- H_{tcp}
- 20 bytes base TCP header
Frequently Asked Questions
How do I see the negotiated MSS for an active connection?
`ss -i` on an established TCP connection shows the negotiated `mss` value directly. `ip route show` can also display a per-route MSS clamp if one has been configured with `advmss`.
Why is MSS important beyond just fitting within MTU?
Setting MSS correctly (often via MSS clamping on routers/firewalls, e.g. for PPPoE or VPN links with reduced MTU) prevents TCP from sending segments that require IP fragmentation downstream — fragmented TCP segments are inefficient and, on paths with PMTUD black holes, can cause connections to hang entirely.
Do both ends of a TCP connection negotiate the same MSS?
No — MSS is advertised independently in each direction during the SYN/SYN-ACK handshake, based on each side's own outbound MTU, so a connection's send and receive MSS can differ if the path has asymmetric MTU constraints.