A WireGuard MTU optimization tool that discovers the optimal MTU for WireGuard tunnels using ICMP Path MTU Discovery.

If your WireGuard MTU is too high, packets get fragmented (slow). If it's too low, you're wasting bandwidth on overhead. Wire-Seek finds the sweet spot automatically.

1. Path MTU Discovery - Sends ICMP Echo packets with the Don't Fragment (DF) bit set
2. Binary Search - Efficiently finds the optimal MTU in ~8 probes instead of 200+
3. WireGuard Calculation - Subtracts the correct overhead for your tunnel:
   • IPv4: 60 bytes (20 IP + 8 UDP + 32 WireGuard)
   • IPv6: 80 bytes (40 IP + 8 UDP + 32 WireGuard)

You MUST use the --tunnel flag when testing through an existing WireGuard tunnel.

Why does this matter?

• Without --tunnel: Wire-Seek subtracts WireGuard overhead (60/80 bytes) from the path MTU
• With --tunnel: The overhead is already applied by your tunnel, so we report the path MTU as-is

If you test through a tunnel WITHOUT the --tunnel flag, you'll get a value ~60 bytes too low (double subtraction).

Download the latest binary from Releases.

# Linux (amd64)
curl -LO https://github.com/yeya/wire-seek/releases/latest/download/wire-seek-linux-amd64
chmod +x wire-seek-linux-amd64
sudo mv wire-seek-linux-amd64 /usr/local/bin/wire-seek

go install github.com/yeya/wire-seek@latest

Or clone and build:

git clone https://github.com/yeya/wire-seek.git
cd wire-seek
go build -o wire-seek .

# Basic usage (requires root for raw ICMP sockets)
sudo wire-seek <target-host>

# Examples
sudo wire-seek 10.0.0.1              # WireGuard peer IP (outside tunnel)
sudo wire-seek vpn.example.com       # Hostname
sudo wire-seek -v 8.8.8.8            # Verbose mode
sudo wire-seek -6 2001:db8::1        # Force IPv6
sudo wire-seek -q vpn.example.com    # Quiet mode (for scripting)
sudo wire-seek -max-mtu 1420 10.0.0.1    # Limit to WireGuard-safe range
sudo wire-seek -max-mtu 9000 10.0.0.1    # Jumbo frame network

# Testing through an existing tunnel (IMPORTANT: use --tunnel flag!)
sudo wire-seek -tunnel 8.8.8.8       # Verify tunnel MTU is working

Wire-Seek: WireGuard MTU Optimizer
Target: 10.0.0.1 (10.0.0.1)
Protocol: IPv4

Discovering path MTU (range: 1280-1500)...

Results:
  Path MTU:      1500 bytes
  WireGuard MTU: 1440 bytes

Add to your WireGuard config:
  MTU = 1440

Add the discovered MTU to your WireGuard configuration:

[Interface]
PrivateKey = ...
Address = 10.0.0.2/24
MTU = 1440  # <-- Add this line

Then restart the interface:

sudo wg-quick down wg0
sudo wg-quick up wg0

MIT License - see LICENSE for details.