GRE MTU Overhead

GRE encapsulation overhead

GRE adds an outer IP header and a GRE header to the original packet. These headers reduce the space available for the inner packet.

The physical path MTU remains unchanged after GRE is added, so the maximum size of the encapsulated packet must be reduced accordingly.

Effects of incorrect MTU

Packets that exceed the tunnel path MTU may be fragmented or dropped.

Common symptoms include incomplete page loads, stalled TLS sessions, retransmissions and applications failing while basic ICMP tests still succeed.

Typical symptoms

• Fragmentation on the tunnel path
• TCP retransmissions and slow page loads
• Broken PMTUD behavior
• Traffic that passes basic tests but fails in applications

Mitigation tunnels

GRE is commonly used for remote DDoS mitigation because customer infrastructure can remain in place. The tunnel adds an encapsulation layer and reduces the available MTU.

Incorrect endpoint MTU values or incomplete PMTUD support can cause failures once normal application traffic uses the tunnel.

Correcting MTU and MSS

Typical corrections include reducing interface MTU, clamping TCP MSS and validating the complete path.

MTU and MSS settings must be consistent across both tunnel endpoints and the complete forwarding path.

Configuration checks

GRE mitigation keeps customer infrastructure at its existing location, but MTU, encapsulation and routing must be configured for the complete path.