Calculate maximum transmission unit and payload size after protocol header overhead.
The Maximum Transmission Unit (MTU) is the largest packet size an interface can send without fragmentation. Standard Ethernet uses 1500 bytes, jumbo frames raise that to 9000 for high-throughput LANs, and PPPoE reduces it to 1492 to make room for its 8-byte header. Encapsulating traffic inside a VPN or tunnel (IPsec, WireGuard, GRE, OpenVPN) adds overhead bytes that must be subtracted from the underlying interface's MTU to avoid fragmentation or silent packet drops when the Don't Fragment bit is set.
Effective MTU with tunnel overhead
effective_mtu = base_mtu − vpn_overhead
PPPoE adds an 8-byte header (6 bytes PPPoE + 2 bytes PPP) on top of the standard 1500-byte Ethernet payload, so the usable payload for upper layers shrinks to 1492 bytes to stay within the Ethernet frame limit.
A common safe value is 1420 for WireGuard (60 bytes overhead under 1500 Ethernet) and roughly 1436-1446 for IPsec, though exact overhead varies with the specific encryption/authentication algorithms and whether NAT-T is in use — subtract the actual overhead from your path's base MTU.
Packets larger than the path's actual MTU get fragmented, or dropped outright if the Don't Fragment bit is set and no ICMP 'fragmentation needed' message gets through (common with firewalls blocking ICMP), causing mysterious connection stalls — Path MTU Discovery exists to detect and avoid this.