TCP Segment, MTU, MSS & Fragmentation
The segment header, size limits on the wire, and what happens when data is too big
This chapter covers two related things: the fields inside a TCP segment header, and the size limits that decide how big each chunk on the wire can be — MTU, MSS, fragmentation, and PMTUD. Together they explain why data is chopped the way it is.
The TCP segment header
A TCP header is about 20 bytes (before options) and carries everything TCP needs: source and destination ports, the sequence and acknowledgement numbers, control flags, the receive window, and a checksum.
The control flags
- SYN
- Start a connection (handshake).
- ACK
- This segment acknowledges received data.
- FIN
- Gracefully close this direction.
- RST
- Abruptly reset/abort the connection.
- PSH / URG
- Push data to the app now / mark data as urgent.
MTU — Maximum Transmission Unit
The MTU is the largest frame a given link can carry in one piece. For classic Ethernet the MTU is 1500 bytes. Anything larger must be split before it can cross that link.
MSS — Maximum Segment Size
The MSS is the largest amount of application data a single TCP segment can hold. It is the MTU minus the IP and TCP headers: 1500 − 20 − 20 = 1460 bytes on standard Ethernet. TCP uses the MSS to decide how to slice your byte stream.
IP fragmentation
If an IP packet is still too large for a link’s MTU, the IP layer can fragment it into smaller pieces that are reassembled at the destination. Fragmentation works, but it is inefficient and fragile — losing one fragment means resending the whole thing — so it is generally avoided.
Path MTU Discovery
To avoid fragmentation, hosts use PMTUD (Path MTU Discovery). They send packets marked "Don’t Fragment"; if one hits a link with a smaller MTU, that router returns an ICMP "Fragmentation Needed" telling the sender the smaller size. The sender then shrinks its packets to fit the whole path.
The DF bit
The DF (Don’t Fragment) bit in the IP header is what makes PMTUD work: it forbids routers from fragmenting the packet, forcing them to send back the ICMP error instead. If those ICMP messages are blocked by a firewall, PMTUD breaks — a classic cause of mysterious stalled connections.