MSS (Maximum Segment Size) is the largest amount of application data that a device can place inside a single TCP segment. It may sound like a small technical detail, but MSS plays an important role in network performance, reliable data delivery, and avoiding unnecessary packet fragmentation.
If the MSS is too large for the network path, TCP traffic can experience packet loss, retransmissions, slow connections, or even complete connection failures. That is why understanding it is useful for network administrators, website owners, and anyone troubleshooting TCP/IP connectivity.
Let’s see exactly how it works.
Table of Contents
What is MSS (Maximum Segment Size)?
MSS (Maximum Segment Size) defines the maximum amount of TCP payload, measured in bytes, that one device tells another it can receive in a single TCP segment.
The important word here is payload.
MSS does not include the TCP header or IP header. It refers only to the actual data carried inside the TCP segment.
TCP endpoints can announce their MSS during the establishment of a connection. The MSS option appears in TCP segments carrying the SYN flag, meaning it is exchanged as part of the TCP connection setup. Each endpoint announces the maximum segment size it is prepared to receive.
Think of it as saying:
“You can send data to me, but please keep each individual portion below this size.”
This helps TCP choose efficient segment sizes before transferring larger amounts of data.
How does MSS (Maximum Segment Size) work?
TCP divides a stream of application data into smaller pieces called segments.
When a client starts a TCP connection, it sends a SYN packet. That packet can contain an MSS value. The server can then send its own MSS value in the SYN-ACK response.
The two values do not necessarily have to be identical because MSS describes what each side is capable of receiving.
After the connection is established, each sender uses the information available to determine how much TCP data it should place into individual packets.
For example, suppose a network uses the common Ethernet MTU of 1500 bytes.
With IPv4 and standard headers:
1500-byte MTU – 20-byte IPv4 header – 20-byte TCP header = 1460-byte MSS
So, 1460 bytes is a common TCP MSS in an IPv4 Ethernet environment.
With IPv6 and its 40-byte fixed header:
1500 – 40-byte IPv6 header – 20-byte TCP header = 1440-byte MSS
TCP or IP options can require additional header space, so the sender may need to place less application data in the actual packet.
Experience Industry-Leading DNS Speed with ClouDNS!
Ready for ultra-fast DNS service? Click to register and see the difference!
MSS vs MTU: What is the difference?
MSS and MTU are closely connected, but they describe different things.
MTU (Maximum Transmission Unit) defines the maximum IP packet size that can be transmitted over a particular network link without exceeding that link’s limit. MSS (Maximum Segment Size) focuses specifically on the TCP data carried inside the packet.
A simple way to remember the difference is:
MTU = headers + data
MSS = TCP data only
For a standard 1500-byte Ethernet MTU using minimum IPv4 and TCP headers, the result is typically a 1460-byte MSS.
The distinction matters because confusing MSS with MTU can lead to incorrect network configurations.
Why is MSS (Maximum Segment Size) important?
A correctly selected MSS can improve both reliability and efficiency.
Networks are made of many different links. A packet may travel through your local network, ISP infrastructure, routers, VPNs, tunnels, firewalls, and data centers before reaching its destination.
Those links do not always support the same packet size.
If TCP creates packets that are too large for part of the route, the network needs another way to deal with them. Depending on the circumstances, packets may be fragmented or dropped.
Repeated packet loss leads to retransmissions. From the user’s perspective, that can appear as slow page loading, interrupted transfers, failed connections, or applications that connect successfully but then stop responding.
This is particularly noticeable when a connection works for small amounts of data but fails as soon as larger packets start flowing.
MSS and Path MTU Discovery
MSS also has an important relationship with Path MTU Discovery (PMTUD).
The Path MTU is the smallest MTU found anywhere between a sender and receiver. PMTUD helps a system determine how large its packets can be without exceeding that limit.
Problems appear when information about an oversized packet does not reach the sender. For example, improperly configured firewalls may block the ICMP messages needed by traditional PMTUD.
The sender can then continue transmitting packets that are too large. They disappear along the path, creating what is commonly known as a PMTUD black hole.
One confusing symptom is that small packets and simple connections may still work while larger TCP transfers time out.
What is MSS clamping?
MSS clamping is a technique used by routers, firewalls, and other network devices to lower the MSS value advertised during TCP connection establishment.
Why would you want to make segments smaller?
VPNs and network tunnels add extra headers to packets. Those additional headers consume part of the available MTU. A TCP packet that fits perfectly on a normal Ethernet connection may therefore become too large after tunnel encapsulation.
By reducing the advertised MSS, a network device encourages TCP endpoints to create smaller segments that fit through the available path.
MSS clamping is often useful when troubleshooting VPNs, PPPoE connections, tunnels, or networks where Path MTU Discovery cannot operate correctly. However, it should not replace fixing an underlying network or firewall misconfiguration when that problem can be corrected.
Does MSS affect DNS?
Yes, but only when TCP is involved.
Most traditional DNS queries use UDP because it provides low overhead and does not require a TCP handshake. However, DNS also uses TCP when necessary, including situations involving larger responses and operations such as zone transfers.
When DNS traffic travels over TCP, normal TCP behavior applies, including MSS negotiation.
An unsuitable MSS can therefore contribute to TCP connectivity problems that affect DNS operations. This is especially relevant when traffic crosses VPNs, tunnels, firewalls, or other infrastructure that reduces the effective MTU.
It is important to remember that MSS itself does not control the size of ordinary UDP-based DNS packets. MSS is a TCP concept.
Common signs of an MSS problem
An MSS or MTU-related problem can be difficult to spot because the network may not fail completely.
Typical symptoms include:
- A TCP connection establishes successfully but stalls during data transfer.
- Small requests work while larger downloads fail.
- Websites partially load or time out.
- Connections become unreliable after enabling a VPN.
- File transfers repeatedly retransmit packets.
- Services work from one network but fail from another.
- TCP-based DNS communication experiences unexpected timeouts.
Tools such as tcpdump can help administrators inspect SYN packets and see the MSS advertised by each endpoint. Comparing those values with the MTU and Path MTU can reveal potential packet-size problems.
Continuous TCP monitoring can also help identify connection failures, latency, and other network-performance problems before they heavily affect users.
Conclusion
MSS (Maximum Segment Size) determines how much application data TCP should carry in an individual segment. Although users rarely see it, it helps TCP move information efficiently while keeping packets within suitable network limits.
For most networks, MSS works automatically. Problems usually appear when VPNs, tunnels, firewalls, or other network components change the effective packet size or interfere with Path MTU Discovery.
When a TCP connection works for small packets but struggles with larger transfers, checking MSS (Maximum Segment Size) and MTU is a good place to start.
