MTU & Encapsulation Calculator

Every figure is a named profile rather than a magic constant, and the table shows which profile contributed what. An MPLS label is four bytes. An IPv4 header is twenty. A VLAN tag is four, and QinQ adds another four.

The IPsec figure is approximate and is marked as such. ESP overhead varies with the cipher, the key size, the padding needed to reach a block boundary, and whether NAT traversal wraps it in UDP. A single number cannot be exact, and a tool implying otherwise is the reason people size tunnels wrongly. Use it as a planning figure and confirm against the devices involved.

Ethernet framing is separate from MTU. The 1500-byte figure is the payload an Ethernet frame carries, not the frame size. Whether to count the 14-byte header depends on what your equipment means by MTU, which differs between platforms — so it is listed as its own line and you can include or exclude it deliberately.

What actually goes wrong. A path that cannot carry a full-sized packet relies on fragmentation or on path MTU discovery. Fragmentation is a performance problem; path MTU discovery relies on ICMP messages that many networks filter, and when they are filtered the result is a connection that completes its handshake and then hangs on the first large transfer. That symptom — small things work, large things do not — is nearly always MTU.