VPN Overhead
Calculate the effective throughput loss caused by VPN tunneling and encryption overhead.
Inputs
Overhead
2.23%
Effective Throughput
97.765Mbps
Throughput Lost to Overhead
2.235Mbps
VPN Header Size
32bytes
Total Packet Size on Wire
1,432bytes
Step by step
Values used
Payload Size (per packet) = 1,400 bytes; VPN Protocol = WireGuard — 32 bytes; Underlying Link Bandwidth = 100 Mbps
VPN overhead percentage
overhead% = vpn_header / (payload + vpn_header) × 100
Effective throughput
effective_throughput = link_bandwidth × (payload / (payload + vpn_header))
Overhead
= 2.23
Effective Throughput
= 97.765 Mbps
Throughput Lost to Overhead
= 2.235 Mbps
VPN Header Size
= 32 bytes
Total Packet Size on Wire
= 1,432 bytes
How it works
Every VPN protocol wraps the original payload in extra headers for encapsulation, encryption, and authentication, and that added header consumes link capacity without carrying user data. The overhead percentage is the VPN header size divided by the total on-wire packet size (payload + header). IPsec (ESP in tunnel mode) typically adds 50-100 bytes depending on the cipher and authentication algorithm; OpenVPN adds 28-48 bytes depending on cipher and whether TCP or UDP is used; WireGuard has a fixed, minimal 32-byte overhead by design.
Formulas
VPN overhead percentage
overhead% = vpn_header / (payload + vpn_header) × 100
- h
- VPN header/trailer size in bytes
- p
- Original payload size in bytes
Effective throughput
effective_throughput = link_bandwidth × (payload / (payload + vpn_header))
- B
- Underlying link bandwidth
Frequently Asked Questions
Which VPN protocol has the lowest overhead?
WireGuard has the lowest and most predictable overhead at a fixed 32 bytes per packet, since it uses a single modern cipher suite (ChaCha20-Poly1305) with a minimal, fixed-size header — no negotiable options to add extra bytes.
Why does IPsec overhead vary so much (50-100 bytes)?
IPsec's ESP overhead depends on the chosen encryption cipher and block size (padding to the cipher's block boundary), the authentication algorithm (HMAC-SHA256 vs SHA1), and whether NAT-Traversal (UDP encapsulation) is in use, all of which add variable bytes.
Does smaller payload size make overhead worse?
Yes — the VPN header is a fixed number of bytes regardless of payload size, so it represents a larger percentage of a small packet than a large one. This is why VPN throughput loss is more noticeable with lots of small packets (e.g. VoIP) than with large file transfers.
Is throughput loss the only cost of a VPN?
No — VPNs also add CPU overhead for encryption/decryption and can add latency from the encapsulation process itself, though on modern hardware with AES-NI or ChaCha20 acceleration, throughput overhead from header bytes is usually the dominant, measurable cost.