MTU Calculator
Usable MTU = link MTU − every encapsulation header; TCP MSS = MTU − 40 (IPv4) or − 60 (IPv6). Example: PPPoE gives 1492 / MSS 1452, WireGuard over IPv4 gives 1440 / MSS 1400. Verify with ping -f -l (Windows) or ping -M do -s (Linux), payload = MTU − 28.
Use the MTU Calculator
Configuration
Results
Overhead Breakdown
MSS clamp and interface MTU
Test the path MTU with ping
Do-not-fragment ping sized to the inner MTU above. It should pass; one byte more should fail with "needs to be fragmented" or "Message too long".
| Windows | |
|---|---|
| Linux | |
| macOS |
Common MTU and MSS Values
On a 1500-byte Ethernet link unless stated. MSS shown for IPv4 TCP (MTU − 40).
| Link or tunnel | Overhead | MTU | MSS |
|---|---|---|---|
| Ethernet, Wi-Fi | 0 B | 1500 | 1460 |
| PPPoE (DSL, many fiber ISPs) | 8 B | 1492 | 1452 |
| GRE over IPv4 | 24 B | 1476 | 1436 |
| VXLAN, IPv4 underlay | 50 B | 1450 | 1410 |
| IPsec ESP, AES-GCM, tunnel | 54 B | 1446 | 1406 |
| WireGuard, IPv4 endpoint | 60 B | 1440 | 1400 |
| IPsec ESP, AES-CBC + SHA-1, tunnel | 62 B | 1438 | 1398 |
| WireGuard default (IPv6-safe) | 80 B | 1420 | 1380 |
| WireGuard over PPPoE (IPv6-safe) | 88 B | 1412 | 1372 |
| GRE over IPsec (common vendor advice) | 100 B | 1400 | 1360 |
| IPv6 minimum link MTU | — | 1280 | 1220 (IPv6) |
| IPv4 minimum reassembly size | — | 576 | 536 |
| Jumbo frames | 0 B | 9000 | 8960 |
IPsec rows include block padding at a 1500-byte link; the overhead changes with packet size. Worked example: PPPoE + WireGuard (IPv4 endpoint) = 1500 − 8 − 60 = 1432, MSS 1392, ping payload 1404.
Summary
The MTU (Maximum Transmission Unit) is the largest IP packet a link carries without fragmentation; standard Ethernet is 1500 bytes. Every tunnel or access protocol on the path takes bytes out of that: PPPoE 8, 802.1Q 4 (only if the frame size is fixed), each MPLS label 4, GRE 24, VXLAN 50 and WireGuard 60 with an IPv4 outer header (add 20 for an IPv6 outer header), and IPsec ESP about 54–85 depending on cipher, NAT-T and block padding. This calculator stacks those layers in the right order, computes ESP padding exactly instead of guessing, and returns the inner MTU, the TCP MSS to clamp (MTU − 40 for IPv4, MTU − 60 for IPv6), Linux and Cisco configuration lines, and the ping commands that prove the result on your real path.
How it works
- Choose the physical link MTU (1500 for Ethernet and Wi-Fi) and tick each layer on the path. Access layers (PPPoE, VLAN tag, MPLS labels) are subtracted first.
- Tunnel layers depend on the outer IP version: GRE is 4 + 20 bytes over IPv4 or 4 + 40 over IPv6, WireGuard 20/40 + 8 UDP + 32, VXLAN 20/40 + 8 UDP + 8 VXLAN + 14 inner Ethernet.
- IPsec ESP tunnel mode is computed exactly: outer IP + optional 8-byte NAT-T UDP + 8 ESP + IV + ICV, then the encrypted part (inner packet + 2-byte trailer + padding) must fill whole cipher blocks (16 bytes for AES-CBC, 4 for AES-GCM).
- Usable inner MTU = link MTU − all overheads. TCP MSS = inner MTU − 20 (IPv4) or 40 (IPv6) − 20 (TCP).
- Test it: send a do-not-fragment ping with payload = MTU − 28 for IPv4 (20 IP + 8 ICMP) or MTU − 48 for IPv6. If it fails, lower the size until it passes; the largest passing payload + 28 is your path MTU.
Use cases
- Find the MSS clamp for a PPPoE broadband connection (MTU 1492, MSS 1452).
- Set the MTU on a WireGuard interface: 1440 with an IPv4 endpoint, 1420 if the endpoint may be IPv6.
- Size the tunnel MTU for IPsec site-to-site VPNs with or without NAT traversal.
- Calculate the underlay MTU a VXLAN fabric needs to carry 1500-byte guest frames (1550 over IPv4, 1570 over IPv6).
- Check GRE over IPsec over PPPoE stacks before deployment.
- Troubleshoot MTU black holes: websites that hang, VPN sessions that connect but stall on large transfers.
- Generate ping commands to measure the real path MTU on Windows, Linux and macOS.