On Wednesday 14 January 2009, Mick wrote:
> On Monday 12 January 2009, Walter Dnes wrote:

> >   The only suggestion I've found via Google is iptables "mangle".  Does
> > it manage to change MSS without changing MTU?  If so, what is the
> > invocation in the "mangle" table?

> It would probably be something like:
>
> iptables --insert OUTPUT --jump TCPMSS --protocol tcp --set-mss 1408

Oops! I just checked the manual:
===========================================================
TCPMSS
This  target  allows  to alter the MSS value of TCP SYN packets, to control 
the maximum size for that connection (usually limiting it to your outgoing 
interface's MTU minus 40).  Of course, it can only be used in  conjunction 
with -p tcp.  It is only valid in the *mangle* table.
===========================================================

Then the rule can be set as follows:
===========================================================
iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
-j TCPMSS --set-mss 1408
===========================================================

If you have forwarding disabled on your box I would try the OUTPUT chain 
instead of FORWARD and see what this gets you.

> I think you can also set the advertised (by your machine) MSS for a network
> using ip route:
>
> ip route add 192.168.1.0/24 dev eth0 advmss 1408
>
> PS.  I am not sure if the above will break your connection because of
> dropped packets, or how it will interact with the MTU set at 1492.  In my
> case I have just set my MTU at 1492 to cater for the PPP authentication on
> my ISP's ADSL network.  I leave the MSS to be at what the kernel wants it
> to be - typically MSS = MTU - 40.

Hope this helps.
-- 
Regards,
Mick