I have there a OpenVPN VPN network connection, where the MSS size 60 gets send out for some reason (don't know why yet). EDIT: Reason: OpenVPN mssfix was mistakenly set to 1

36  92.064383 TCP 52  49991 → 63760 [SYN] Seq=0 Win=65535 Len=0 MSS=60 WS=128 SACK_PERM=1
37  92.064763 TCP 52  63760 → 49991 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 WS=256 SACK_PERM=1

There are two devices on this network, which behave different.

  • Win 10 PC with Filezilla FTP Server
  • Embedded device (PLC) based on VxWorks with internal FTP server

The PC sets the MSS size to 536, but the PLC sets it down to 60 like requested.

41  92.171676 FTP-DATA    576 FTP Data: 536 bytes (PASV) (RETR TCData.br)
67  17.385576 FTP-DATA    100 FTP Data: 60 bytes (PASV) (RETR TCData.br)

Is that implemented on the right way on both sides?

I know that the default TCP MSS is 536, but is there a required minimum size?

  • I have browsed through relevant RFCs and found no mention of a minimum value for MSS. The most relevant sources I could find were tools.ietf.org/html/rfc1122#page-85 and tools.ietf.org/html/rfc6691#section-2. From this it sounds like there is no minimum value. But a sender may need to subtract as much as 80 from the value to account for IPv4 and TCP options, thus an MSS smaller than 81 can potentially lead to breakage. It's not clear to me what the implication of IPv6 option headers would be. – kasperd Jan 26 at 12:41
  • Since the MTU can be as low as 68 bytes it may be necessary to fragment a TCP segment. So for the discussion in tools.ietf.org/html/rfc6691#section-2 to make sense it would have to apply before fragmentation. That means if a sender needs to use the full 40 bytes for IPv4 options and 40 bytes for TCP options and has received an MSS of 81 and has an MTU of 68. It would first produce a 121 byte TCP packet with 1 byte of payload, which is then fragmented into 8 fragments (7 of 68 bytes and one of 65 bytes). That would be a ridiculous overhead, but from my reading it's within specs. – kasperd Jan 26 at 12:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.