Kernaali ToolsCount at the right layer
Ethernet frame: destination + source + type (14 B) | VLAN tags (4 B each) | payload / padding | FCS (4 B). Preamble/SFD (8 B) and interframe gap (12 byte-times) consume link time outside that frame.
| Quantity | Baseline | What is included |
|---|---|---|
| Ethernet IP MTU | 1,500 B | Entire IP packet; excludes Ethernet header and FCS |
| Untagged frame | 1,518 B | 1,500-byte payload + 14-byte header + 4-byte FCS |
| One VLAN tag | 1,522 B | Same IP packet; an extra 4 bytes at Layer 2 |
| Two VLAN tags | 1,526 B | Same IP packet; 8 bytes of tags |
| Minimum untagged frame | 64 B | Includes FCS; payload is padded if necessary |
| IPv4 header | 20 B minimum | Options can increase it |
| IPv6 base header | 40 B | Extension headers add more |
| TCP header | 20 B minimum | Options can increase it |
| UDP header | 8 B | No TCP MSS negotiation |
TCP data budget
Base MSS = IP MTU − fixed IP header − fixed TCP header. With MTU 1,500: IPv4 MSS 1,460; IPv6 MSS 1,440.
The advertised MSS option uses the fixed headers. A sender reduces actual payload for TCP options and IPv6 extensions. Twelve bytes of TCP options leave 1,448 bytes of IPv4 data in a 1,500-byte packet.
MSS clamping affects TCP. It does not repair oversized UDP packets or replace path-MTU discovery.
Tunnel worksheet
Start from the underlay IP MTU. Subtract outer IP, tunnel headers, authentication and worst-case padding. Then subtract the inner IP and transport headers for a data budget.
An illustrative 1,500-byte underlay with a verified 60-byte encapsulation budget leaves 1,440 bytes of inner IP MTU and base IPv4 TCP MSS 1,400.
Overhead varies. GRE options, ESP cipher/padding, NAT-T, additional tunnels and PPPoE change the result. Do not apply one fixed deduction to every VPN.
Symptoms and checks
Small pings work but large transfers stall: inspect path MTU, allow needed ICMP/ICMPv6 errors, and test both directions. A capture may omit FCS or VLAN tags due to offload. Interface counters and capture sizes may therefore count different bytes. Jumbo-frame limits must match across the entire path.