TCP MTU

The MTU signature is the link-layer size implied by the TCP MSS option. PPPoE, IPsec, and some VPN stacks show up as a different MSS than Ethernet.

MTU Signature

Many operating systems derive the maximum segment size specified in TCP options from the MTU of their network interface; that value, in turn, normally depends on the design of the link-layer protocol. A different MTU is associated with PPPoE, a different one with IPSec, and a different one with Juniper VPN.

The format of the signatures in the [mtu] section is exceedingly simple, consisting just of a description and a list of values. Each label corresponds to a specific networking technology or use case, and the associated sig values indicate typical MTU sizes for those technologies.

MTU Analyzed

[TCP MTU] 1.2.3.4:1524 → 4.3.2.1:80
  Link:   DSL
  MTU:    1492

MTU Key Fields

• Link: The [mtu] label whose signature equals the calculated MTU. 1492 is DSL in the bundled file (with 1452 and 1454). No match prints ???.
• MTU: The value taken from the TCP MSS option, in bytes.