MTU (Maximum Transmission Unit) is the largest packet size in bytes that a network interface can transmit in a single frame without fragmentation. For Ethernet the standard value is 1500 bytes. If a packet exceeds the link MTU, it is either split into fragments or dropped, which causes slow or stalled page loads.
This guide explains what MTU and MSS are, the typical values for Ethernet, PPPoE and VPN links, how Path MTU Discovery works and why MTU black holes happen, how to measure the optimal packet size with a ping DF test, and how to configure MTU on your router, Windows and Linux.
What Is MTU
MTU sets the upper bound on the payload of a single link-layer frame. An IP packet up to the MTU is sent whole; if the data exceeds the limit, the sender or an intermediate router must fragment the IP packet into several pieces that are reassembled at the destination. Fragmentation adds overhead and reduces reliability: losing one fragment forces a retransmission of the entire original packet.
It is important to distinguish MTU from MSS. MSS (Maximum Segment Size) is the maximum amount of TCP data in one segment, excluding headers. On classic Ethernet, MSS = MTU − 40 bytes (20-byte IPv4 header + 20-byte TCP header), i.e. 1500 − 40 = 1460 bytes. For IPv6 you subtract 60 bytes. Hosts negotiate MSS when the TCP connection is established (inside the SYN packet), so a correct MSS often prevents fragmentation before any data is even sent.
Typical MTU Values
MTU depends on the link technology and any encapsulation. PPPoE (common on DSL) adds an 8-byte header, so its MTU drops to 1492. VPN tunnels add their own headers (encryption, encapsulation), pushing the effective MTU even lower. Jumbo frames are used in data centres and 1/10 Gbps LANs to reduce CPU overhead.
| Connection type | Typical MTU (bytes) | Recommended MSS |
|---|---|---|
| Ethernet (standard) | 1500 | 1460 |
| PPPoE (DSL) | 1492 | 1452 |
| PPTP VPN | 1400 | 1360 |
| IPsec VPN | 1400–1438 | 1360–1398 |
| WireGuard | 1420 | 1380 |
| OpenVPN (UDP) | 1500 (iface ~1428) | ~1388 |
| Jumbo frames (data centre) | 9000 | 8960 |
VPN values are approximate: the exact overhead depends on the cipher, transport mode (UDP/TCP) and protocol version. Always confirm the real MTU by measurement, not by theoretical calculation alone.
Path MTU Discovery and Black Holes
Path MTU Discovery (PMTUD) is the mechanism described in RFC 1191 that lets hosts determine the smallest MTU along the entire path between sender and receiver. The sender sets the DF (Don't Fragment) flag in the IPv4 header. If a packet reaches a router with a smaller MTU, that router drops the packet and returns an ICMP "Fragmentation Needed" message (type 3, code 4) stating the allowed size. The sender then lowers the size and retransmits.
The problem appears when firewalls or misconfigured routers block all inbound ICMP. In that case the "Fragmentation Needed" message never reaches the sender, which keeps sending oversized packets that are silently discarded. This condition is called an MTU black hole.
Characteristic symptoms of a black hole and a wrong MTU:
- the TCP connection is established (the handshake succeeds), but data transfer stalls — the page starts loading and then freezes;
- sites open partially: text appears but images fail to load;
- small requests (ping, DNS) work, while large ones (file download, POST forms) break;
- VPN errors: the tunnel comes up but applications behind it do not work;
- SSH connects but drops when it prints a large amount of text.
Rule of thumb: if small traffic works but large traffic does not, suspect MTU and blocked ICMP first.
How to Measure and Configure MTU
You find the optimal MTU by trial: send a ping with the DF flag set and gradually reduce the payload size until packets pass without fragmentation. Add 28 bytes (20-byte IP header + 8-byte ICMP header) to the payload that works — that sum is your MTU.
Measuring the packet size
In the examples below 1472 is the payload; 1472 + 28 = 1500, i.e. standard Ethernet. If 1472 fails, drop to 1464, 1452 and so on.
# Windows: -f forbids fragmentation, -l sets the size
ping -f -l 1472 enterno.io
# Linux: -M do sets DF, -s sets the payload size
ping -M do -s 1472 enterno.io
# macOS: -D sets DF, -s sets the size
ping -D -s 1472 enterno.ioA message like "Packet needs to be fragmented but DF set" (Windows) or "Message too long" (Linux) means the size exceeds the path MTU — lower the value.
Setting the MTU
# Windows: list interface names
netsh interface ipv4 show subinterfaces
# Windows: set MTU 1492 on the chosen interface
netsh interface ipv4 set subinterface "Ethernet" mtu=1492 store=persistent
# Linux: temporary (until reboot)
ip link set dev eth0 mtu 1492
# Linux: persistent via netplan/NetworkManager or /etc/network/interfacesOn a router the MTU is set in the WAN interface settings (typically 1492 for PPPoE). Many firmwares also offer an MSS clamping option — it automatically adjusts the MSS in TCP packets to the real tunnel MTU, which reliably fixes fragmentation problems even when PMTUD is broken.
How to Check
To quickly assess a host's reachability and response time, use our free Ping and port checker: it shows packet loss and latency, which indirectly point to link problems. For full header and availability diagnostics, use the enterno.io HTTP header checker.
Related reading: how to fix high ping and packet loss, fine-tuning TCP connections and fixing the ERR_CONNECTION_CLOSED error.
Frequently Asked Questions
Which MTU value should I use by default?
For a normal wired Ethernet connection keep the standard 1500 bytes. If you use DSL with PPPoE, set 1492. For a VPN, lower the MTU to the value found by the ping DF test. Do not change the MTU at random: a wrong value will degrade, not improve, your connection.
How does MTU differ from MSS?
MTU is the maximum size of the whole frame at the link layer, including the IP and TCP headers. MSS is only the TCP data payload without headers. On Ethernet, MSS = MTU − 40 bytes for IPv4. Hosts negotiate MSS during connection setup, whereas MTU is configured on the interface itself.
What is an MTU black hole?
It is a situation where DF-flagged packets exceed the path MTU, but the ICMP "Fragmentation Needed" message is blocked by a firewall and never reaches the sender. As a result large packets are silently lost: the connection is established but data transfer stalls. It is fixed by lowering the MTU or enabling MSS clamping.
Do I need jumbo frames at home?
Usually not. Jumbo frames (MTU 9000) are useful in data centres and LANs for moving large amounts of data with less CPU load. At home they rarely help and require every device on the segment to use the same larger MTU, otherwise fragmentation appears.
Why is my VPN slow or dropping?
Often the cause is a tunnel MTU that is too large. A VPN adds encryption headers, lowering the effective MTU to 1400 or less. If you leave it at 1500, large packets fragment or get lost. Reduce the VPN interface MTU and, where possible, enable MSS clamping on the gateway.