Tunnel MTU Calculator
Derive the inner MTU and TCP MSS clamp for any tunnel type from the underlay path MTU.
Inputs
Tunnel MTU
1,444bytes
TCP MSS to Clamp
1,404bytes
Total Overhead
56bytes
Fragments for a 1500 B Packet
2
MSS Clamping Required
Yes
Step by step
Values used
Underlay path MTU = 1,500 bytes; Tunnel type = IPsec ESP tunnel, AES-GCM (56 B); Extra 802.1Q tags on the path = 0 tags; Inner IP version = IPv4 + TCP (40 B)
Tunnel MTU
tunnel MTU = path MTU − encapsulation bytes; MSS = tunnel MTU − 40 for IPv4 or − 60 for IPv6.
Tunnel MTU
= 1,444 bytes
TCP MSS to Clamp
= 1,404 bytes
Total Overhead
= 56 bytes
Fragments for a 1500 B Packet
= 2
MSS Clamping Required
= Yes
How it works
Every tunnel steals bytes from the inner MTU, and TCP only learns about it through path-MTU discovery, which is frequently blocked by firewalls dropping ICMP. Clamping MSS on the tunnel interface removes the dependency by telling both endpoints the true segment size during the handshake. This is the single most common cause of 'the ping works but the website hangs' — small packets pass, full-size segments are silently dropped.
Formula
Tunnel MTU
tunnel MTU = path MTU − encapsulation bytes; MSS = tunnel MTU − 40 for IPv4 or − 60 for IPv6.
- path MTU
- Smallest MTU on the underlay between the two tunnel endpoints
- MSS
- Largest TCP segment payload that fits without fragmenting
Frequently Asked Questions
How is Tunnel MTU calculated?
tunnel MTU = path MTU − encapsulation bytes; MSS = tunnel MTU − 40 for IPv4 or − 60 for IPv6. Every tunnel steals bytes from the inner MTU, and TCP only learns about it through path-MTU discovery, which is frequently blocked by firewalls dropping ICMP. Clamping MSS on the tunnel interface removes the dependency by telling both endpoints the true segment size during the handshake.
Why does Tunnel MTU matter?
This is the single most common cause of 'the ping works but the website hangs' — small packets pass, full-size segments are silently dropped.
What values do I need to enter?
This calculator takes 4 inputs: Underlay path MTU, Tunnel type, Extra 802.1Q tags on the path, Inner IP version. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.