MTU and MSS Calculator

The failure looks like anything except an MTU problem

A path with a reduced MTU produces one of the most confusing failure modes in networking. Small packets pass, so the TCP handshake completes, DNS works and a ping succeeds. The connection then hangs the moment a full sized packet is sent, which in practice means the page loads and then stalls, or the SSH session connects and freezes on the first long output. Because everything small works, the investigation usually starts everywhere except the MTU.

Path MTU discovery relies on ICMP that is often blocked

The mechanism that should handle this sends a packet with the do not fragment bit set, and a router that cannot forward it returns an ICMP fragmentation needed message telling the sender the correct size. When a firewall blocks ICMP type 3, that message never arrives, the sender keeps retransmitting the same oversized packet, and the connection stalls indefinitely. This is the single most common cause of an MTU black hole, and blocking all ICMP is how it gets created.

MSS clamping fixes it at the gateway

Rather than relying on discovery, a gateway can rewrite the maximum segment size in passing TCP SYN packets so both endpoints agree on a size that fits. This works regardless of whether ICMP is filtered and regardless of what the endpoints believe their MTU to be. It applies only to TCP, so UDP based protocols such as QUIC and VPN encapsulation still need the MTU set correctly on the interface.

Related tools

• Port Scanner — Check which common ports respond on a host and understand what each exposed service means. Scan only systems you are authorised to test.
• DNS Misconfiguration — Analyze DNS records (TXT, SPF) for security gaps.
• TLS Compat Tester — Check client-server compatibility for TLS versions.
• Firewall Rule Risk — Evaluate firewall rules for over-permissive exposure.