What is MSS and why is it important for TCP performance in a capture?

• A. MSS is the maximum segment size negotiated during the handshake; it affects fragmentation and throughput; Wireshark displays MSS in TCP options.
• B. MSS stands for Main Session Size.
• C. MSS determines encryption strength.
• D. MSS is a DNS attribute.

Answer: (A)

MSS is the maximum amount of TCP payload that can be sent in a single segment, and it is negotiated during the TCP three‑way handshake. The SYN carries an MSS option, the other side picks or echoes a value, and the final negotiated number becomes the limit for data in each TCP segment. In a capture you’ll typically see this value in the TCP options of the initial handshake, which tells you how large each segment can be.

Why this matters for TCP performance: the MSS, together with the IP header and TCP header sizes, needs to fit within the path MTU to avoid fragmentation. If the MSS is well chosen, data can flow with minimal overhead and few retransmissions. A larger MSS means fewer packets for the same amount of data, reducing per-packet processing and header overhead; a smaller MSS increases the number of packets, more headers, and potentially more overhead and lower throughput. Wireshark prints the MSS in the TCP options, helping you interpret whether the session is using a generous or conservative segment size.

MSS isn’t about encryption strength, DNS attributes, or a term like Main Session Size.