MSS clamping

networking

Rewriting TCP's advertised Maximum Segment Size downward in the SYN so segments fit a tunnel's reduced MTU without fragmentation or black holes.

The device-side escape from PMTUD failures: fix the promise, not the path.

MSS clamping is a router rewriting the Maximum Segment Size that endpoints advertise in their TCP handshake, lowering it so segments fit through a tunnel whose overhead the endpoints know nothing about.

It exists because the correct mechanism fails in practice. Path MTU discovery is supposed to handle this by having a router report that a packet was too large, but the ICMP messages carrying that report are widely filtered, so the sender never learns and simply retries forever. The symptom is the familiar one: the connection establishes, small requests work, and anything large hangs, which points at everything except the real cause.

Clamping is honestly a workaround rather than a fix, and worth understanding as such. It is a middlebox altering a negotiation between two endpoints who never agreed to it, which is the layering violation the internet architecture was designed to avoid, and it is standard practice on essentially every VPN and GRE deployment because the alternative does not work. It is also a good illustration of why protocol evolution is difficult: the network is full of devices making decisions the endpoints cannot see.

← All glossary entries