Subject: [Ntp] Is the real MTU still 576?

From: Hal Murray <[email-masked]>
Date: Sun, 14 Jun 2020 17:52:22 -0700

There was mention in the Roughtime discussion that the official minimum MTU is 
still 576.

It's easy for a NTP packet using NTS to get over that.  If you drop a few 
packets, the request will have a few cookie placeholders and the response will 
have a few extra cookies.

Is the real MTU still 576?  What fraction of the net will carry Ethernet size 
packets of roughly 1500 bytes?

Or rather, what fraction of the net can't carry 1500 byte packets and/or how 
well do things work there?

Cookies are roughly 100 bytes.  Should we limit requests to 3 cookie 
placeholders?  (maybe 4)

-- 
These are my opinions.  I hate spam.

---

From: Steven Sommars <[email-masked]>
Date: Sun, 14 Jun 2020 22:02:40 -0500

Figure 9 in
http://www.leapsecond.com/ntp/NTP_Suitability_PTTI2020_Revised_Sommars.pdf
shows some size limits seen between test clients and several thousand NTP
servers.  Some of the limits are intentional DDoS mitigations.  I also saw
IPV4/6  ICMP "too big" starting at 1280 bytes.    Using a different NTP
port should reduce the likelihood of hitting a DDoS limit, but probably
would not help the MTU problem.

I don't know how to compute a fraction, as the MTUs are path dependent.

On Sun, Jun 14, 2020 at 7:52 PM Hal Murray <[email-masked]> wrote:

> _______________________________________________
> ntp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ntp
>

---

From: Daniel Franke <[email-masked]>
Date: Mon, 15 Jun 2020 10:42:00 -0400

Support for 1500 bytes or more at the link layer is pretty much universal,
but that includes IP and UDP headers so for the application you have less
than that. Those headers may contain options so you can't assume they'll be
some particular size, and you may have multiple layers of them due to VPN
tunneling, leaving an MTU of less than 1500 bytes for the innermost layer.
What's ultimately left over for the application payload is the "segment
size", rather than the "transmission unit".

The only "correct" option if you want to go beyond the minimum MTU is to
use path MTU discovery, but for a stateless protocol like NTP that's not
really practical, at least not for servers. IPv6 mandates a minimum MTU of
1280 bytes. Again that's an MTU, not an MSS, but nonetheless it's very rare
that a 1280-byte segment would get fragmented, no matter whether it's going
over IPv4 or IPv6. I think "MSS is probably at least 1280" makes a good
rule of thumb whenever PMTUD isn't practical.

---

From: Watson Ladd <[email-masked]>
Date: Mon, 15 Jun 2020 12:04:11 -0400

On Mon, Jun 15, 2020 at 10:42 AM Daniel Franke <[email-masked]> wrote:
>
> Support for 1500 bytes or more at the link layer is pretty much universal, but that includes IP and UDP headers so for the application you have less than that. Those headers may contain options so you can't assume they'll be some particular size, and you may have multiple layers of them due to VPN tunneling, leaving an MTU of less than 1500 bytes for the innermost layer. What's ultimately left over for the application payload is the "segment size", rather than the "transmission unit".
>
> The only "correct" option if you want to go beyond the minimum MTU is to use path MTU discovery, but for a stateless protocol like NTP that's not really practical, at least not for servers. IPv6 mandates a minimum MTU of 1280 bytes. Again that's an MTU, not an MSS, but nonetheless it's very rare that a 1280-byte segment would get fragmented, no matter whether it's going over IPv4 or IPv6. I think "MSS is probably at least 1280" makes a good rule of thumb whenever PMTUD isn't practical.

We have some data backing this up:
https://blog.cloudflare.com/increasing-ipv6-mtu/. 98% of IPv4 and
93.23% of IPv6 hosts advertised 1340 MSS in SYN. 1280 is likely to be
much closer to 99% of IPv6, but sadly we didn't get that measurement.

Sincerely,
Watson Ladd

--
"Man is born free, but everywhere he is in chains".
--Rousseau.

---

From: Erik Kline <[email-masked]>
Date: Sat, 20 Jun 2020 18:58:33 -0700

> There was mention in the Roughtime discussion that the official minimum MTU is

Leaving aside the question of what size is practical in the face of
anti-DDoS measures, and to expand a bit on Marcus's comment on that
thread, the 576 number is the minimum size that an IPv4 node is
required to be able to reassemble.  The actual MTU of any link may be
much smaller but hosts must be able to reassemble up to a 576 byte
packet from however many fragments.

See also RFC 791 section 3.1 and RFC 1122 sections 3.3.2 and 3.3.3.

This is a subtly different thing from the IPv6 min MTU of 1280.  (See
references to 1500 in RFC 8200 section 5.)