Maximum Segment Size (MSS) and Maximum Transmission Unit (MTU) are measurements of packet size. MSS only measures the size of the packet’s payload (the data the packet is carrying), while MTU measures the size of the whole packet, including the header. Packets that exceed the maximum size that the MTU can measure will be broken down into smaller fragments before being reassembled again. In contrast, packet payloads that exceed the MSS will simply be dropped and cannot proceed to the destination.
IPSec usually adds another set of layers in the packet payload or the whole packet. This can quickly take up several bytes, and both MTU and MSS will handle the transmission process noticeably slower than without IPSec. Each whole packet typically contains 1,500 bytes of data. With the standard headers and TCPs being about 20 bytes each, the usual amount of bytes that the payload contains is about 1,460. Another set of layers can add up to 40 to 60 bytes of data when IPSec is used. This excess will be fragmented by the MTU and then reassembled to complete the process.