MTU Calculator
Calculate max payload for a given MTU and encapsulation type.
Reviewed by the ToolNestr Editorial Team — July 2026
Payload size calculator
Encapsulation overhead reference
| Encap type | Overhead (bytes) | Effective payload at 1500 MTU |
|---|
How the MTU calculator works
The MTU (Maximum Transmission Unit) is the largest packet size — including headers — that can traverse a network link without fragmentation. When you add encapsulation layers such as VLAN tags, PPPoE headers, GRE tunnels, or IPsec security envelopes, each layer consumes bytes from the MTU budget, reducing the space available for your actual data payload.
The calculation is straightforward: Payload = MTU − Overhead. The overhead depends on the encapsulation protocol. A standard Ethernet frame has no overhead for the payload calculation (the 14-byte Ethernet header and 4-byte FCS are part of the Layer 2 frame and are already accounted for by the 1500-byte MTU convention). When you add a VLAN tag, an additional 4-byte 802.1Q header is inserted, reducing the payload capacity to 1496 bytes. PPPoE adds 8 bytes (6-byte PPPoE header + 2-byte PPP protocol ID), dropping the payload to 1492 bytes at 1500 MTU.
Efficiency is calculated as Efficiency = Payload / MTU × 100. This tells you what percentage of the MTU is actually carrying useful data versus being consumed by headers. For most encapsulations the efficiency is above 99% at standard 1500 MTU, but the absolute overhead matters more than the percentage — losing 8 bytes per packet may not sound like much, but at 50,000 packets per second that is 400 KB/s of overhead.
Encapsulation overhead details
| Encapsulation | Overhead (bytes) | Payload at 1500 MTU | Typical use case |
|---|---|---|---|
| None (raw Ethernet) | 0 | 1500 | Standard LAN traffic |
| VLAN (802.1Q) | 4 | 1496 | Network segmentation, trunk links |
| PPPoE | 8 | 1492 | DSL / broadband connections |
| GRE | 24 | 1476 | Tunneling, VPNs (without IPsec) |
| IPsec (ESP tunnel) | 50–57 | 1443–1450 | Secure VPNs, site-to-site tunnels |
| Q-in-Q (802.1ad) | 8 | 1492 | Provider bridging, data center |
IPsec overhead varies because of padding, authentication trailer length, and the specific transform (ESP-AES-GCM vs ESP-AES-CBC + HMAC). The calculator uses a default of 54 bytes for IPsec, which is typical for AES-GCM with a 16-byte ICV.
Worked example
Consider a standard Ethernet link with 1500 byte MTU running PPPoE encapsulation. PPPoE is commonly used on DSL broadband connections. The PPPoE header adds 8 bytes (6 bytes for the PPPoE session layer and 2 bytes for the PPP protocol identifier). The calculation is:
Payload = 1500 − 8 = 1492 bytes
Efficiency = 1492 / 1500 × 100 = 99.47%
This means that out of every 1500-byte packet, 1492 bytes carry actual application data and only 8 bytes are overhead. While the efficiency looks excellent, the impact is more visible on smaller packets. A 64-byte control packet with 8 bytes of PPPoE overhead wastes 12.5% of the transmission on headers.
Use cases
VPN tunnel optimization
When configuring a VPN, especially IPsec or OpenVPN over GRE, the encapsulation overhead must be accounted for to avoid fragmentation. Many VPN clients automatically reduce the MTU on the virtual interface (e.g., to 1400 bytes) to leave room for the tunnel headers. If the MTU is not adjusted, TCP connections may stall, web pages may load partially, and file transfers may fail silently.
Router and firewall configuration
Network engineers frequently need to set the correct MTU on router interfaces, firewall policies, and VPN tunnels. A misconfigured MTU is one of the most common causes of intermittent connectivity issues. Using this calculator, you can determine the correct MTU or MSS (Maximum Segment Size) clamp value for any encapsulation stack. The general rule is MSS = MTU − 40 (for TCP/IP headers) − encapsulation overhead.
Troubleshooting MTU-related issues
Symptoms of MTU problems include: websites loading partially (text without images), SSH connections timing out, email attachments failing to send, and VPN connections dropping large file transfers. The root cause is typically a path that has a lower MTU than the sender's interface. Using Ping with the Don't Fragment (DF) flag set at increasing packet sizes (e.g., ping -M do -s 1472 google.com) can help discover the actual path MTU.
Tips for MTU tuning
Path MTU Discovery (PMTUD)
Path MTU Discovery is a technique that allows TCP to automatically determine the maximum packet size that can traverse the entire path from source to destination without fragmentation. The sender marks packets with the DF (Don't Fragment) flag. If a router along the path needs to fragment but cannot (because DF is set), it sends back an ICMP Fragmentation Needed message with the next-hop MTU. The sender then reduces its segment size. PMTUD works well on well-configured networks, but some firewalls and middleboxes block ICMP messages, breaking PMTUD and causing connection hangs — a phenomenon known as a "PMTUD black hole."
Jumbo frames (9000 MTU)
Jumbo frames increase the standard Ethernet MTU from 1500 to 9000 bytes. They are commonly used in data centers, iSCSI storage networks, and high-performance computing clusters. The advantage is reduced CPU overhead (fewer interrupts per GB transferred) and better throughput. However, all devices on the Layer 2 path — switches, routers, and NICs — must support and be configured for jumbo frames. A single device set to 1500 MTU on a path will force fragmentation or drop jumbo frames. At 9000 MTU, the impact of encapsulation overhead is proportionally smaller: an 8-byte PPPoE header consumes only 0.09% of the MTU budget instead of 0.53%.
MSS clamping
Many routers and firewalls implement MSS (Maximum Segment Size) clamping as a workaround for MTU issues. MSS clamping rewrites the TCP SYN packet's MSS option to a value that accounts for encapsulation overhead, preventing the TCP sender from generating segments that exceed the effective path MTU. For example, on a PPPoE link with 1492 byte MTU, the MSS should be clamped to 1452 (1492 − 40 for TCP/IP headers). This is often configured automatically on DSL routers but may need manual adjustment on enterprise equipment.
Related tools
- Subnet Mask Cheat Sheet — Interactive CIDR-to-hosts reference table.
- Bandwidth vs Throughput Calculator — Estimate real achievable throughput from rated bandwidth.
- DNS Record Builder — Build correctly formatted DNS zone file records.
Frequently asked questions
What is MTU?
Maximum Transmission Unit — the largest packet size that can traverse a network link without fragmentation.
What is the standard MTU?
Ethernet standard is 1500 bytes. With VLAN tagging it becomes 1496, with PPPoE it drops to 1492.
Why does encapsulation reduce MTU?
Each encapsulation layer adds header bytes, reducing the space available for actual data payload.
What happens if I exceed the MTU?
Packets are fragmented or dropped, causing performance issues and connectivity problems.