Subject: a silly question

From: "QinKe" <[email-masked]>
Date: Tue, 28 Jun 2005 20:46:13 +0800

Dear all:

I am a novice about IPsec. Now I have a silly question. As we know, the MTU of Ethernet is 1500. IPsec will add additional headers to IP packet. If a packet's size is just 1500, then how will IPsec deal with such occasion? The packet's size will larger than 1500 after some headers are added. So fragmentation is needed here. But on the other hand, IPv6 routers can't do fragmentation. So I am in confusion.

Best regards
　　　　　　　　
　　　　　　　　[email-masked]
　　　　　　　　　　2005-06-28
--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Jeroen Massar <[email-masked]>
Date: Tue, 28 Jun 2005 15:12:15 +0200

On Tue, 2005-06-28 at 20:46 +0800, QinKe wrote:
> Dear all:
> 
> I am a novice about IPsec. Now I have a silly question.
> As we know, the MTU of Ethernet is 1500. IPsec will add additional
> headers to IP packet. If a packet's size is just 1500, then how will
> IPsec deal with such occasion? The packet's size will larger than 1500
> after some headers are added. So fragmentation is needed here.
> But on the other hand, IPv6 routers can't do fragmentation. So I am in confusion.

In this case the first router, actually the machine itself
(localhost/loopback) will notify, the sender, itself, that the packet is
too big. The host stack notices this and will start fragmenting.

The on-the-path routers will never fragment.

Greets,
 Jeroen