Stack tunnel headers (VPN, IPSec, GRE, PPPoE, WireGuard…) on top of an Ethernet link and see how much payload survives. The calculator returns effective MTU, TCP MSS for v4 and v6, UDP payload, and warns about DF blackholes when the stack exceeds the path MTU.
Headers add up from the outside in. Order doesn't change the byte total but reflects the wire layout.
| Layer | Bytes | Notes |
|---|---|---|
| Ethernet II frame header | 14 | Excluding 4-byte FCS — MTU is the payload only. |
| 802.1Q VLAN tag | 4 | One per stacked tag. QinQ adds 8. |
| IPv4 header | 20 | Up to 60 with options. DF flag inhibits fragmentation. |
| IPv6 header | 40 | Fixed; extension headers stack on top. |
| TCP header | 20 | Up to 60 with options (MSS, SACK, timestamps). |
| UDP header | 8 | Length and checksum. |
| PPPoE (header + PPP) | 8 | 6 PPPoE + 2 PPP. Common DSL constraint. |
| GRE | 4 | +4 with key, +4 with sequence, +4 with checksum. |
| IPSec ESP (tunnel, AES-GCM) | ~58 | 20 outer IP + 8 SPI/seq + 8 IV + 16 ICV + 2-6 pad/next. |
| WireGuard | 60 | 20 IP + 8 UDP + 32 WG (type+receiver+counter+poly1305). |
| OpenVPN (UDP, TLS) | ~69 | 20 IP + 8 UDP + 41 OVPN (varies by cipher). |
| VXLAN | 50 | 14 inner Ethernet + 8 VXLAN + 8 UDP + 20 IP. |
| 6in4 / 4in6 | 20 or 40 | Just the outer IP header — no transport layer. |
| L2TP/IPSec | ~73 | L2TP(12) + UDP(8) + IPSec(~53). |
-M do -s <size> to probe the real path MTU.