I was reading RFC4987 describing SYN cookies and seems Maximum Segment Size (MSS) is encoded in the SYN cookie and I am not sure why that is the case? Can someone explain why we need the MSS in the SYN cookie?
Let's assume your MTU is 1400 and MTU of your server is 1500. When you try to download the file, without MSS or PMTUD, server would try to send you file in around 1500 byte packets which would be dropped since your MTU is only 1400.
With Path MTU Discovery, server can discover what is the MTU size, the thing is, it relies on ICMP. So when packet is dropped, the ICMP message is sent back. However, if ICMP is blocked, server must rely on MSS value included in SYN packet. So if your lower your MTU, your MSS value in SYN packets will be lowered as well so the servers will now know how to size the packets.
Your router can also be altering MSS field in SYN packets to adjust to MTU of your broadband line like ADSL. It's iptables feature "SYN TCPMSS clamp to PMTU". This is because if your broadband line MTU is lower than your WIFI MTU (which is normally 1500), router may need to clap it for you so the packets coming back from the internet servers are sized for your Broadband and not WIFI.