## 5 Implemented Scenarios and Experimental Results
The Maximum Transmission Unit (MTU), or link MTU, is measured in bytes and represents the largest packet size that can be sent over a hop without fragmentation. This differs from the Path MTU (PMTU), the smallest MTU among all hops in a path. Iperf assesses IP network bandwidth availability. When packet loss is present, PMTU discovery may occasionally underestimate the MTU. To validate the discovered MTU, conducting multiple tests for consistency is advisable. However, if the discovered MTU matches a recognized standard, it is typically not an inadvertent underestimation. Common values for MTU are shown in ${IFACE_MTU} ip a a 10.0.0.1 peer 10.0.0.2 dev fou0 ip r a $7

The overhead introduced by various tunneling protocols varies depending on the specific protocol and configuration. Focus on Overlay links deployed is shown in ${IFACE_MTU} ip a a 10.0.0.1 peer 10.0.0.2 dev fou0 ip r a $8 These overheads should be considered when designing and implementing network tunnels, as they affect the overall payload size and network performance. \begin{table}
\begin{tabular}{c c} \hline \hline
**MTU TYPE** & **MTU SIZE (Bytes)** \\ \hline IP over SONET & 4470 \\ Ethernet Jumbo Frames & 9000 \\ IP over ATM Ethernet Jumbo Frames & 9180 \\ Classic Ethernet & _1500_ \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Common MTU values by link type. Figure 13: Clustered RTT distribution trend for the central group of tunnels illustrated in Figure 7.

When utilizing a tunnel interface over IPsec, the overhead includes IPsec headers, the outer IP header for IPsec, and the additional IP header for tunnel encapsulation. The IPsec header comprises the Security Association (SA) information, encryption and authentication headers (if applied), and other IPsec-related metadata. IPIP encapsulation introduces another IP header, encompassing the tunnel endpoints' source and destination IP addresses and any supplementary IP options. The total overhead for a tunnel over IPsec is the aggregate of the IPsec and tunnel type headers, along with any additional IPsec overhead. This overhead varies based on the specific IPsec configuration (e.g., encryption and authentication algorithms) and tunnel type configuration. A detailed IPsec and tunnel configurations analysis is required to determine the specific overhead. Generally, IPsec overhead ranges from tens to hundreds of bytes, while the IPIP header typically adds twenty bytes. In Libreswan, the default Maximum Segment Size (MSS) for both tunnel and transport modes is usually derived from the MTU. For tunnel mode, the default MTU is generally 1400 bytes, leading to an MSS of 1360, calculated as MTU minus the IP and TCP header sizes (each 20 bytes for IPv4). For transport mode, where the default MTU is typically 1500 bytes, the MSS is 1460, computed similarly. These calculations are based on standard IPv4 and TCP header sizes. Additional packet headers, options, or extensions may affect the MSS value. Nonetheless, these calculations provide a general guideline for determining MSS in Libreswan based on default MTU values. Table 6 summarizes the VPN tunneling protocols used. Each protocol has its strengths and trade-offs, making them suitable for various network configurations and requirements. Figures 14 and 15 show the connections performance for TCP and UDP connections, respectively, obtained by the _ipref_ command. The experiments with Iperf and Netperf were conducted as follows. The server (Iperf/Netperf) is started on two endpoints: TCP mode and UDP mode. The MTU is set at the moment of tunnel creation. For IPERF TCP, the client sends 100 Mb of traffic to the server for each negotiated overlay/VPN channel. In IPERF UDP mode, the client sends 100 Mb of traffic to the server for each negotiated overlay/VPN channel with a bandwidth of 100 MB. For NETPERF TCP, a TCP network performance test is performed between the local host and the remote host at 10.0.0.1 for 10 s. During the test, CPU usage is measured on both the local and remote sides. In NETPERF UDP mode, a network performance test