What the numbers mean
Carrier payload ceiling is the packet-size budget that contains the selected encapsulation and the inner IP packet. It deliberately excludes Ethernet header, FCS, preamble, and inter-frame gap. Inner MTU is the largest complete inner IP packet after all selected layers are removed.
Advertised MSS follows RFC 6691: subtract only the fixed IP header (20 B for IPv4 or 40 B for IPv6) and the fixed 20 B TCP header from the MTU. Actual TCP data must be smaller when IP extension/options or TCP options are present, so the calculator shows that separately.
For a no-fragment ICMP echo test, subtract the IP header and the 8-byte ICMP echo header. The displayed ping payload includes no link or tunnel headers because those were already removed while finding the inner MTU.
Formulas used
inner MTU = carrier ceiling − Σ tunnel overheadrequired carrier = target inner MTU + Σ tunnel overheadadvertised MSS = inner MTU − fixed IP header − 20actual TCP data = inner MTU − all inner IP headers − all TCP headersUDP payload = inner MTU − all inner IP headers − 8Operational cautions
RFC 1191 defines IPv4 Path MTU Discovery around the Don't Fragment bit and ICMP “fragmentation needed” messages. Blocked ICMP, asymmetric paths, or a tunnel not represented in the stack can make a mathematically correct value fail in practice. Test both directions.
RFC 8200 requires every IPv6 link to have an MTU of at least 1,280 bytes and says IPv6 routers do not fragment packets while forwarding. A calculated inner IPv6 MTU below 1,280 is therefore a design warning, not a recommended configuration.
GRE keys, checksums, and sequence fields add bytes. Security tunnels can add variable padding or authentication data. VXLAN presets here include an inner 14-byte Ethernet header but no inner VLAN tag. A VLAN tag often changes frame size rather than the configured IP MTU; only add it when it consumes the exact carrier budget you entered.
Preset structures come from RFC 2516 for PPPoE, RFC 2784 for base GRE, RFC 7348 for VXLAN, and the WireGuard protocol description. WireGuard padding to a 16-byte boundary and optional GRE fields are called out as implementation checks rather than silently folded into a fixed number.
Frequently asked questions
Why are advertised MSS and actual TCP data different?
MSS negotiation excludes only fixed IP and TCP headers. TCP options and IP options or extension headers still occupy space in individual packets, so the sender must reduce the data in those packets. Showing both avoids silently advertising a nonstandard smaller MSS.
Should I include Ethernet overhead?
No, not when your starting value is a conventional IP-facing MTU such as 1,500. This calculator's carrier ceiling begins at the payload carried by that outer interface. Use custom overhead only if your known constraint is defined at a different boundary.
Does this test my network?
No. It performs deterministic arithmetic in your browser, sends no packets, and reads no interface settings. Confirm the result with your equipment documentation and controlled path tests.