MSS

networking

Stands for: Maximum Segment Size

The largest chunk of actual data a TCP segment carries, after headers.

Maximum Segment Size is the MTU minus the IP and TCP header overhead, the real payload each segment can hold. "MSS clamping" lowers it deliberately to avoid fragmentation across a link with a smaller MTU, a common fix on tunnels.

MSS is the largest payload TCP will put in a single segment, and it is negotiated at connection setup rather than discovered later. Each side announces what it can accept, the smaller value wins, and both sides size their segments accordingly for the life of the connection.

That timing is what makes it useful. Path MTU discovery reacts to a problem after packets are already being dropped, and it depends on ICMP messages that firewalls frequently discard, so the failure is silent and the connection hangs. MSS is agreed before any data flows, so if the value is right the oversized packet is never sent in the first place.

MSS clamping is the practical intervention. A router in the path rewrites the announced value downward so both endpoints negotiate a size that survives the tunnel overhead ahead of them, which is why it appears in essentially every VPN and GRE configuration guide. The symptom it fixes is the familiar one: the connection establishes, small requests work, and anything large hangs forever. When you see that pattern, MSS is the first thing to check and usually the answer.

Also known as: mss, mss clamping

← All glossary entries