When investigating highly specific network failures—such as small web pages loading fine, but large file transfers freezing—engineers often discover issues related to MTU and MSS. Understanding these concepts requires looking at how data is physically packaged on the wire.
What is MTU (Maximum Transmission Unit)?
The MTU dictates the absolute maximum size of an IP packet (including the IP headers and data payload) that can be transmitted out of a network interface without being broken into smaller pieces (fragmented).
On standard Ethernet networks, the default IP MTU is universally 1500 bytes.
What is MSS (Maximum Segment Size)?
While MTU applies to the entire IP packet at Layer 3, the MSS applies strictly to the TCP payload at Layer 4. The MSS tells the other side of a TCP connection: "This is the largest chunk of application data I can accept in a single packet."
Because an IPv4 header is 20 bytes, and a TCP header is 20 bytes, the standard MSS calculation is: 1500 (MTU) - 20 (IP) - 20 (TCP) = 1460 bytes.
| Concept | Default Ethernet Value | Applies To |
|---|---|---|
| MTU | 1500 Bytes | The entire IP Packet (Headers + Data) |
| MSS | 1460 Bytes | The TCP Payload (Application Data only) |
The Problem: Tunnels and Encapsulation Overhead
MTU issues almost always occur when traffic enters a VPN (IPsec) or a tunnel (GRE, PPPoE).
If a PC generates a standard 1500-byte packet and sends it to the firewall, the firewall must encrypt it and wrap it in a new IPsec header to send it across the VPN. That new header adds roughly 60 bytes of overhead. The packet is now 1560 bytes. But the firewall's WAN interface has a hard physical MTU limit of 1500 bytes.
The firewall has two choices:
- Fragment the packet: Break it into two smaller packets. This destroys router CPU performance and is deeply inefficient.
- Drop the packet: If the PC set the "Don't Fragment" (DF) bit on the packet (which almost all modern OSs do), the firewall drops the packet and sends an ICMP "Fragmentation Needed" message back to the PC, telling it to try again with a smaller size (Path MTU Discovery).
Symptoms of MTU Mismatch
- Small tasks work perfectly (pings, DNS queries, SSH).
- Large tasks stall completely (downloading a PDF, loading a massive website image).
- The VPN tunnel says "Connected," but internal web apps hang endlessly on a white screen.
Troubleshooting and Workarounds
1. Ping with DF Bit (Diagnostics)
You can use ping to find the maximum allowed MTU on a path by forcing the Don't Fragment flag and adjusting the payload size.
ping 8.8.8.8 -f -l 1472
# Linux (Forces DF and sets payload size)
ping 8.8.8.8 -M do -s 1472
If this returns "Packet needs to be fragmented but DF set," lower the number (e.g., 1400) until pings succeed. This proves an MTU bottleneck exists on the path.
2. TCP MSS Clamping
In routed environments where ICMP messages are aggressively blocked by firewalls (breaking Path MTU Discovery), the standard fix is TCP MSS Clamping. The VPN firewall intercepts the initial TCP handshake and artificially lowers the MSS value (e.g., to 1350). The PC and the Server agree to send smaller chunks of data, guaranteeing the packets will fit through the VPN tunnel without ever needing fragmentation.