Uniqcli

MTU, MSS and tunnel layer ledger

Subtract explicitly entered encapsulation and distinguish base-header TCP MSS from actual data space with options.

Networking

MTU, MSS and tunnel layer ledger

Subtract explicitly entered encapsulation and distinguish base-header TCP MSS from actual data space with options.

Example inputs · Replace these with your measurements to build your plan.

Do not include outer Ethernet/FCS/preamble. Include inner Ethernet only when carried inside the tunnel.

Method, example and sources
  1. Subtract each encapsulation layer from the entered outer path IP MTU.
  2. Subtract fixed inner IP and TCP headers to show the base MSS ceiling.
  3. Subtract actual options/extensions to calculate packet data space.
  4. Flag payload overflow and IPv6 inner MTU below 1280 without approving the path.

Worked example. 1,500 minus 20-byte outer IPv4 and 4-byte GRE leaves 1,476 inner bytes. IPv4 base MSS is 1,436; 12 TCP-option bytes leave 1,424 data bytes.

Your planning result

Entered data fits this ledger

Base-header MSS and actual packet data differ when IP/TCP options are present.

Inner IP MTU
1,476bytes
Base-header MSS ceiling
1,436bytes
Data with entered options
1,424bytes
Encapsulation
24bytes
MTU, MSS and tunnel layer ledger: detailed result
Layer inside outer IP MTUBytes
Outer IPv420
GRE4
Inner fixed IP header20
IP options/extensions0
TCP including options32
  • The starting limit is an outer IP MTU, not Ethernet frame size. Exclude outer Ethernet/FCS/preamble/IFG; include an inner Ethernet header only when the tunnel carries it.
  • Path MTU discovery, negotiation and implementation behavior remain separate. The advertised MSS ignores options; senders reduce actual data for options.

From the catalog

Routers & Gateways

Explore related listings, then confirm the exact model requirements against your plan. These listings are not an automatic compatibility or capacity verdict.

Browse routers & gateways Browse network security & firewalls Get help with the specification

How to use this result

Encapsulation can reduce the space available to the packet carried inside it. A layer ledger is more reliable than a universal VPN allowance because tunnel formats, options and nesting differ. Enter only bytes contained inside the starting IP MTU, and identify whether an inner Ethernet frame is carried by the selected tunnel.

What to verify next

Advertised TCP MSS normally subtracts fixed IP and TCP headers; the sender then reduces actual data for options. The worksheet displays both quantities to avoid teaching those as the same value. Path discovery, negotiated MSS, fragmentation behavior and encryption padding require platform evidence. An IPv6 result below its minimum packet size is flagged for review, not presented as a working tunnel configuration.

Worked example

1,500 minus 20-byte outer IPv4 and 4-byte GRE leaves 1,476 inner bytes. IPv4 base MSS is 1,436; 12 TCP-option bytes leave 1,424 data bytes.

MTU, MSS and tunnel layer ledger — Uniqcli