I've been reading about maximum transmission unit (MTU) which is the size of the largest protocol data unit (PDU) that can be communicated in a single, network layer, transaction.

I'm generating a few network traffic right now and capture it in Wireshark, unfortunately I'm not sure which one is the MTU size value in PCAP file.

Please let me know how to inspect this value in Wireshark.

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Jan 5, 2021 at 21:08

3 Answers 3


There is nothing in the packet that will tell you what the MTU is. It's an attribute of an interface. The MTU can vary along the path from source to destination. So for example, the link from A to B might have an MTU of X, but the link from B to C, might be Y. There's no way to tell from the PCAP file.

You might be able to infer the MTU value of some link the packet traveled if you see fragmented packets. But that would be an educated guess at best.

  • MTU is available on TCP SYN packets anyway.
    – Joshua
    Apr 10, 2018 at 19:27
  • 1
    @Joshua You mean MSS, don't you? This is derived from the destination's MTU which might be the path MTU - or not.
    – Zac67
    Apr 10, 2018 at 19:58
  • @Zac67: My understanding is that intermediate routers are intended to edit it so that by the time it is received it is the path MTU.
    – Joshua
    Apr 10, 2018 at 20:00
  • @Joshua I see - since routers are supposed to be L3 devices, this doesn't usually work and has been pretty much abandoned. Path MTU Discovery works by actually trying to send packets of the desired size, on IPv4 this requires the DF bit to be set.
    – Zac67
    Apr 10, 2018 at 20:25
  • 1
    @Joshua Intermediate routers are not intended to edit the MSS. But some are able to do it as a workaround for broken PMTU discovery. That technique is usually called MSS clamping. And it is a very effective way to work around networks which broke PMTU discovery one way or another.
    – kasperd
    Apr 10, 2018 at 22:52

As Ron has nicely explained, you can't reliably observe the MTU in a packet capture. You can find a minimum value from the largest frame size you've observed (minus L2 overhead) and you can guess.

Since the MTU is a property of the IP binding to a network interface you can just ask your operating system, e.g. in Windows

netsh interface ipv4 show interfaces

You'd need to do that for every single node as there's no way to tell from the outside - there's no standard protocol to ask a node via network.


Can you see in that sentence....

enter image description here

  • 1
    That is not the MTU. That is the TCP segment size after the IP packet fragments have been reassembled. You cannot determine the MTU from what you show.
    – Ron Maupin
    Oct 19, 2021 at 17:22
  • While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. - From Review
    – rnxrx
    Oct 24, 2021 at 1:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.