The Maximum Segment size (MSS) is an important consideration when troubleshooting connectivity via the Internet/Intranet. As the packets are routed via the Internet/Intranet, the packets must traverse through multiple routers in the path between two hosts. In a perfect world, each TCP segment can pass through every router without being fragmented. If the segment size is too large for any of the routers through which the data traverses, the segments that are too large must be fragmented. For most End-Users, the MSS is set automatically by the operating system, but as you will see in the article, a router/firewall can modify the packet and change the MSS. The MSS is easily calculated from just a few known variables; you can use this information to predict what data packets would look like once they were captured from such as TCPDUMP or Wireshark.

A few weeks ago I encountered a very interesting issue while capturing data with tcpdump in my lab for a research project that I was working; the affects of IPv4 packet exchange between two hosts.  What I observed was the MSS  in the original packet that was transmitted from host A to host B was being modified; I expected the MSS of the initial SYN packet from host A to be 1460 and the SYN ACK packet from Host B to be 1460. This however, was not the case as I had observed the MSS on the initial SYN packet from Host A as 1350 when sending a packet to Host B utilizing TCP on port 80:

1. Host A SYN bit sent with MSS of 1460
2. SYN …