Calculate TCP maximum segment size from MTU and header overhead.
The Maximum Segment Size is the largest chunk of TCP payload data that fits into a single frame without fragmentation, calculated by subtracting the IP header (20 bytes for IPv4, 40 for IPv6) and the TCP header (20 bytes, more with options) from the link's MTU. Getting MSS right matters because if it is set too high for the actual path, routers must either fragment IPv4 packets (inefficient) or, if the Don't Fragment bit is set, drop them and rely on Path MTU Discovery — which can silently fail behind misconfigured firewalls that block the required ICMP messages, a classic cause of connections that hang on large transfers but work fine for small ones.
MSS from MTU
MSS = MTU − IP_header(20 or 40) − TCP_header(20) − TCP_options
For IPv4 with no TCP options: 1500 − 20 (IP) − 20 (TCP) = 1460 bytes. For IPv6, the larger 40-byte IP header reduces it to 1500 − 40 − 20 = 1440 bytes.
Tunneling protocols (PPPoE, GRE, IPsec) add their own encapsulation headers on top of the standard IP/TCP headers, effectively reducing the usable MTU. If the MSS isn't lowered to match, oversized packets get fragmented or dropped, which is a common cause of connections that work for small requests but hang or fail on larger transfers like HTTPS pages with big responses.
Each side of a TCP connection advertises its own MSS in the SYN packet during the three-way handshake, based on its own outgoing interface's MTU. Both sides then use the smaller of the two advertised values for the connection, though this does not account for smaller MTUs on intermediate hops unless Path MTU Discovery is also functioning correctly.