Network Download Time, TCP Bandwidth-Delay Product (BDP) & VPN MTU/MSS Calculator (2026)

First, ISP speeds are measured in decimal **megabits per second** ($100,000,000\text{ bits/s}$), whereas file sizes are measured in **megabytes** (8 bits = 1 byte, so $100 / 8 = 12.5\text{ MB/s}$ raw rate). Second, on a standard 1500-byte MTU link, every packet carries 20 bytes of IPv4 header + 20 bytes of TCP header + 12 bytes of TCP timestamps + 38 bytes of Ethernet L1/L2 framing—leaving $1448 / 1538 = \mathbf{94.15\%}$ payload goodput, which equals $\approx 11.77\text{ MB/s}$ (or $11.22\text{ MiB/s}$).

TCP requires the sender to keep unacknowledged data buffered in flight until the receiver returns an ACK packet one Round-Trip Time (RTT) later. The maximum data in flight on the wire is the **Bandwidth-Delay Product**: $\text{BDP (Bytes)} = (\text{Bandwidth in bps} \times \text{RTT in seconds}) / 8$. On a 1 Gbps link with 100 ms RTT, $\text{BDP} = 12.5\text{ MB}$. If the OS TCP Receive Window (`RWIN`) is capped at the legacy 64 KB default, maximum single-connection throughput is strictly limited to $64\text{ KB} / 0.1\text{s} = \mathbf{5.24\text{ Mbps}}$—wasting 99.5% of your gigabit connection.

WireGuard encapsulates inner packets inside UDP with a 32-byte WireGuard header (4B type + 4B key index + 8B nonce + 16B Poly1305 auth tag), plus an 8-byte UDP header, plus a 20-byte IPv4 header (total 60 bytes) or a 40-byte IPv6 header (total **80 bytes**). On a standard 1500-byte Ethernet WAN, $1500 - 80 = \mathbf{1420\text{ bytes}}$. However, if either endpoint uses **PPPoE Fiber/DSL** (which consumes 8 bytes for PPPoE framing, reducing WAN MTU to 1492), you must subtract another 8 bytes: $1492 - 80 = \mathbf{1412\text{ bytes}}$.

When testing with ICMP `ping` and the Don't Fragment (DF) flag set, you must subtract **28 bytes** (20-byte IPv4 header + 8-byte ICMP Echo header) from the target MTU to get the ping payload size. For a 1500 MTU link, the maximum unfragmented ping payload is $1500 - 28 = \mathbf{1472\text{ bytes}}$ (`ping -M do -s 1472 1.1.1.1` on Linux, `ping -D -s 1472 1.1.1.1` on macOS, or `ping -f -l 1472 1.1.1.1` on Windows).

The TCP Maximum Segment Size (MSS) announced during the 3-way SYN handshake specifies the maximum TCP payload per packet: $\text{MSS} = \text{MTU} - 20\text{B (IPv4)} - 20\text{B (TCP)} = \text{MTU} - 40$ (or $\text{MTU} - 60$ for IPv6). Configuring `--clamp-mss-to-pmtu` on your router rewrites the SYN packet's MSS option so remote servers never send packets larger than your tunnel MTU.