MSS (Maximum Segment Size)
MSS is the largest TCP payload (excluding headers) that can be sent in a single segment. MSS is negotiated during TCP handshake and derived from MTU: MSS = MTU - IP header (20) - TCP header (20). For 1500-byte Ethernet MTU, MSS is 1460 bytes. MSS avoids IP fragmentation by keeping segments within link MTU.
Definition
Maximum Segment Size is a TCP option exchanged during the three-way handshake. Each side announces its MSS – the largest TCP payload it can receive without IP fragmentation. The sender uses the minimum of its own MSS and the peer's advertised MSS. MSS accounts for IP and TCP headers but not Ethernet framing. The standard MSS for 1500-byte Ethernet is 1460 bytes (1500 - 20 IP - 20 TCP). With TCP options (timestamps add 12 bytes), the effective payload per segment drops to 1448 bytes. Misconfigured MSS is a common source of connectivity issues in VPN and tunnel environments – packets that exceed the tunnel's inner MTU are fragmented or dropped. MSS clamping at the tunnel endpoint (iptables -j TCPMSS --clamp-mss-to-pmtu) fixes this transparently.
Examples
- –iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
- –tcpdump 'tcp[tcpflags] & tcp-syn != 0' -v shows MSS option in SYN
- –sysctl net.ipv4.tcp_mss_default=1460
Related Protocols
Related Terms
MTU (Maximum Transmission Unit)
MTU is the largest packet size a network link can carry without fragmentation. Ethernet MTU is 1500 bytes. If a packet exceeds the path MTU, it is fragmented (IPv4) or dropped with ICMP Packet Too Big (IPv6). Path MTU Discovery (PMTUD) finds the lowest MTU along a route.
Fragmentation
IP fragmentation splits packets larger than the link MTU into smaller fragments for transmission, reassembled at the destination. Fragmentation hurts performance – any single lost fragment requires retransmitting the entire original packet. IPv6 does not allow router fragmentation; only endpoints can fragment.