What is MSS?
Maximum Segment Size
MSS (Maximum Segment Size) is the largest amount of TCP payload data a host is willing to receive in one segment, announced in the TCP handshake.
Each side of a TCP connection puts an MSS option in its SYN or SYN-ACK, and the other side won't send segments larger than that. The value is normally the interface MTU minus the IP and TCP headers. On standard 1500-byte Ethernet that gives 1460 for IPv4 (1500 minus 20 bytes of IP header and 20 of TCP) and 1440 for IPv6, whose header is 40 bytes. The MSS covers the payload only, never the headers, and it is chosen independently in each direction, so the two ends of a connection can announce different values. A host that receives no MSS option must assume a small default, 536 bytes for IPv4. MSS is advertised once, at the start; it is not renegotiated if the path changes later.
The trouble is that each host only knows its own interface MTU, not the smallest MTU on the path. If a tunnel, PPPoE link or VPN along the way has a smaller MTU, full-size segments are too big. Path MTU discovery (PMTUD) should handle this, but when ICMP "packet too big" messages are filtered, large packets vanish while small ones work: an MTU black hole. Web pages that half load and SSH sessions that hang when output scrolls are classic symptoms. The common fix is MSS clamping: a router rewrites the MSS option in SYN and SYN-ACK packets passing through it so both ends choose segments that fit. In VyOS that is ip adjust-mss on an interface. The Packets That Never Come Back lesson diagnoses an MTU black hole and fixes it with MSS clamping.
Lessons that use MSS
- Packets That Never Come BackTeaches this term · Intermediate · 75 min
Advanced packet capture with tcpdump, and how to find where packets die on a VyOS network: missing NAT and return routes, asymmetric routing through a stateful firewall, and MTU black holes, all diagnosed on a real VyOS router.
- Site-to-site VPN with WireGuard on VyOSIntermediate · 35 min
Join two sites' private LANs across the internet with WireGuard on VyOS: keys and peers, the AllowedIPs mistake and what it teaches, what the internet actually sees, and the tunnel's smaller MTU.