Description

It is very common in modern-day networks that different devices along the network path have different Maximum Transmission Unit (MTU) values. Packets that are sized bigger than the MTU value need to be fragmented when they are passed through. Fragmentation, in turn, causes latency in TCP transfers as it is an overhead on the end hosts as well as on the intermediate devices. Fragmentation also increases the number of TCP retransmissions as the loss of a fragment requires the whole packet to be re-transmitted.

This article explains how to configure TCP maximum segment size (MSS) clamping on SRX devices and how it helps in mitigating TCP fragmentation reduction during TCP transfer. 

Symptoms

Topology

host-machine-network >>>>>(mtu-1500) Router (mtu-1300)>>>>>>(mtu 1300)SRX(mtu 1500)>>>>>Internet

Solution

TCP MSS is the maximum amount of data that a host can accept in a single TCP segment. During the TCP three-way handshake, the client and the server announce their respective TCP MSS values. During data transfer, the sender sends packets with TCP segments less than or equal to the MSS value announced by the receiver.

When TCP MSS is configured on the SRX device, the firewall will intercept the TCP SYNC packets and change the MSS to the configured value (what is known as TCP MSS clamping) to prevent packet fragmentation.

To configure MSS clamping on the SRX device

#set security flow tcp-mss all-tcp mss  <mss-value>   
#commit

The following illustrations show the packet structure on the ingress and egress interfaces of an SRX device, which is configured with a TCP MSS value of 1200:

  1. The screen capture on the left shows a TCP MSS value of 1460, which was originally sent by the client, and the capture on the right shows the modified TCP MSS value of 1200 when it passed through the SRX device.


    alt

  2. The screen capture on the right shows a TCP MSS value of 1460, which was the reply sent by the server, and the screen capture on the left shows the modified TCP MSS value of 1200 after it passed through the SRX device.


    alt

    After the three-way handshake is complete, both the server and the client believe that the other end can only receive 1200 bytes as the maximum TCP segment size. 

    As a result, the maximum size of the IP packet (applied to TCP traffic only) would be 1240 bytes, which is less that the minimum MTU (1300) along the path, thus eliminating any unnecessary TCP fragmentation.

Modification History

2026-04-21: Minor, non-technical changes made for search optimization