Simple definition
MSS (Maximum Segment Size) is the maximum amount of TCP payload a host advertises that it is willing to receive in one segment.
Technical definition
MSS is exchanged as a TCP option during connection establishment. It represents the maximum TCP payload and is derived with IP and TCP header overhead in mind relative to the local path MTU.
What is it used for?
Adapt TCP segment size to avoid fragmentation or loss when the available MTU is reduced, especially across some tunnels.
Practical example
A firewall can apply MSS clamping on a VPN tunnel to reduce the value advertised by TCP endpoints.
Common issues
- MSS is too large for the real path MTU
- MSS clamping is applied in only one direction
- MSS is confused with MTU or total IP packet size
How it works / role
During the SYN and SYN-ACK, each endpoint can advertise its MSS. The peer then limits the TCP payload sent to that endpoint to the advertised value. An intermediate device configured for MSS clamping can lower the option to fit a path with a smaller MTU.
Key takeaway: Exact behavior can vary by version, product, and architecture; always validate on the environment actually deployed.