What is MSS clamping, how do you configure it on IOS and Linux, and what does it not fix?
Show the answer
Say this first
MSS clamping makes a router rewrite the MSS option in TCP SYN and SYN-ACK segments passing through it, so
both hosts agree to segments that fit the smallest link without relying on ICMP. On IOS it is
ip tcp adjust-mss 1360 on the interface, typically a tunnel; on Linux it is an iptables or nftables
rule. It only works for TCP whose handshake passes through the device, so it does nothing for UDP traffic
such as QUIC, DNS or other VPNs.
Go deeper
IOS-XE
interface Tunnel0
ip mtu 1400
ip tcp adjust-mss 1360
ipv6 mtu 1400
ipv6 tcp adjust-mss 1340ip tcp adjust-mss acts on SYNs entering and leaving the interface, only ever lowers the value, and
accepts 500 to 1460. 1360 = 1400 - 20 (IP) - 20 (TCP). For IPv6 subtract 60.
Linux router
iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtunftables:
nft add rule inet filter forward tcp flags syn tcp option maxseg size set rt mtuJunos SRX
set security flow tcp-mss ipsec-vpn mss 1350What clamping does not cover
- UDP: QUIC, DNS, IPsec from hosts, WireGuard. They need PMTUD or conservative sizes of their own.
- TCP whose SYN takes a different path (asymmetric routing) than the data.
- TCP inside an encrypted tunnel the router only sees from outside.
- Packets that are already large for other reasons, such as non-TCP protocols.
So clamping is a strong safety net, but ICMP should still be allowed.
They will ask next
Why is 1360 such a common number?
It fits GRE over IPsec with headroom: an
ip mtuof 1400 covers GRE's 24 bytes plus IPsec ESP overhead in tunnel mode with common ciphers. 1400 minus 40 bytes of IPv4 and TCP headers gives 1360.Does adjust-mss raise an MSS that is lower than the configured value?
No. It only rewrites a SYN whose MSS is larger than the configured value.
Which direction should you apply it on a PPPoE link?
On the dialer or the inside interface, either works because the command handles SYNs in both directions through that interface. The usual value is 1452 for a 1,492-byte PPPoE MTU.
Traps
- Claiming MSS clamping fixes all MTU problems. It only helps TCP whose handshake it sees.