Finding MSS for a remote connection that uses tunnelling

Question

I'm working on a codebase where we're trying to test network health by verifying if we can ping the remote site having payload = MSS without any packet fragmentation (using -df flag).

Typically, for a connection without L2 tunnel, this MSS would be 1472 (1500 - TCP header (28)). However, if there's some tunnel then this MSS would be lower than this value. I'm wondering if there's any way to figure out this additional tunnel header so that I can reduce my packet size to ensure ultimately 1500 bytes reaches the ethernet/physical layer.

Answer 1

Ping uses ICMP, not TCP, so you cannot test TCP with ping. You should research PMTUD to find the smallest MTU in the path. You can then set your MTU correctly to prevent fragmentation.

Also, your calculation about the MSS is incorrect. The ethernet frame size is 1518, but ethernet is confined to the local network. The MTU is the largest packet size allowed on a link (1500 for ethernet, larger for other protocols, such as Wi-Fi, token ring, etc.), and you must subtract the IP header (20 to 60 bytes for IPv4, 40 bytes for IPv6) and the TCP header (20 to 60 bytes). In most cases for TCP on IPv4 on ethernet, the MSS will be 1460 (1500 - 20 - 20 = 1460). Usually, a tunnel will be a layer-3 tunnel (it is a very bad idea to have a layer-2 tunnel). A layer-3 tunnel MTU (and thus the MSS) will be reduced by the tunnel overhead (IP and tunnel header sizes) and that varies by the tunnel protocol used.

In any case, with TCP you simply do not need to worry about the MSS because TCP handles segmenting the stream for you, and trying to do that yourself will be a lot of trouble, and it can cause suboptimal performance. You simply use PMTUD to determine the correct MTU and adjust your MTU accordingly, then simply let TCP do its job.