MTU Calculator (Linux)
Determine the effective MTU for an interface type after subtracting VPN or tunnel encapsulation overhead.
Inputs
Used only when Interface Type is Custom
e.g. ~60 for IPsec ESP+AH, ~50 for OpenVPN UDP, ~40-60 for WireGuard/GRE
Effective MTU
1,500bytes
Base MTU
1,500bytes
Overhead Subtracted
0bytes
Recommendation
MTU looks standard.
Step by step
Values used
Interface Type = Ethernet (1500); Custom Base MTU = 1,500; VPN / Tunnel Overhead = 0 bytes
Effective MTU with tunnel overhead
effective_mtu = base_mtu − vpn_overhead
Effective MTU
= 1,500 bytes
Base MTU
= 1,500 bytes
Overhead Subtracted
= 0 bytes
Recommendation
= MTU looks standard.
How it works
The Maximum Transmission Unit (MTU) is the largest packet size an interface can send without fragmentation. Standard Ethernet uses 1500 bytes, jumbo frames raise that to 9000 for high-throughput LANs, and PPPoE reduces it to 1492 to make room for its 8-byte header. Encapsulating traffic inside a VPN or tunnel (IPsec, WireGuard, GRE, OpenVPN) adds overhead bytes that must be subtracted from the underlying interface's MTU to avoid fragmentation or silent packet drops when the Don't Fragment bit is set.
Formula
Effective MTU with tunnel overhead
effective_mtu = base_mtu − vpn_overhead
- M_b
- base interface MTU
- O
- tunnel/VPN encapsulation overhead in bytes
Frequently Asked Questions
Why do PPPoE connections use MTU 1492 instead of 1500?
PPPoE adds an 8-byte header (6 bytes PPPoE + 2 bytes PPP) on top of the standard 1500-byte Ethernet payload, so the usable payload for upper layers shrinks to 1492 bytes to stay within the Ethernet frame limit.
What is a safe MTU for a WireGuard or IPsec tunnel?
A common safe value is 1420 for WireGuard (60 bytes overhead under 1500 Ethernet) and roughly 1436-1446 for IPsec, though exact overhead varies with the specific encryption/authentication algorithms and whether NAT-T is in use — subtract the actual overhead from your path's base MTU.
What happens if MTU is set too high for the path?
Packets larger than the path's actual MTU get fragmented, or dropped outright if the Don't Fragment bit is set and no ICMP 'fragmentation needed' message gets through (common with firewalls blocking ICMP), causing mysterious connection stalls — Path MTU Discovery exists to detect and avoid this.