Work out mtu and mss instantly with clear inputs, formula shown and shareable results.
MSS is the MTU minus the IP and TCP headers, so plain IPv4 Ethernet gives 1500 - 20 - 20 = 1460 bytes. Every layer of encapsulation reduces it further: IPsec tunnel mode costs around 73 bytes and VXLAN 50. Getting MSS wrong causes packets that cannot be fragmented to be dropped silently, which is the classic cause of connections that establish but then hang.
MSS derivation
effective MTU = path MTU - encapsulation bytes; MSS = effective MTU - IP header - TCP header (20 for IPv4, 40 for IPv6)
Routers rewrite the MSS value in TCP SYN packets to fit the tunnel MTU, which avoids relying on path MTU discovery. It is standard practice on VPN and PPPoE edges.
It depends on ICMP fragmentation-needed messages, which many firewalls block. The sender then keeps retransmitting full-size packets that are silently dropped.