Subject: SIIT translation

From: "Vishwas Manral" <[email-masked]>
Date: Mon, 5 Dec 2005 01:57:08 -0800

Hi Eric/ folks,

As the ICMPv6 has a checksum which includes a pseudo header, though the
ICMPv6 does not have the same, I think we cannot do SIIT (stateless
translation) for fragmented ICMPv4 packets. We need to get all the
fragements before we can find the checksum, hence it becomes stateful.

I think this seems to be missing in the RFC, though it talks about a
similar case for UDP packet with checksum 0. Is my understanding
correct?

Thanks,

Vishwas

---

From: Erik Nordmark <[email-masked]>
Date: Mon, 05 Dec 2005 13:56:59 -0800

> fragements before we can find the checksum, hence it becomes stateful.

I haven't looked at the details recently, but I think the addition of 
the pseudo-header checksum is solvable without needing state in the 
translator. The pseudo-header (from the IPv6 header) is available in the 
same packet as the ICMP checksum field.
Thus the checksum can be adjusted based on the delta of adding or 
deleting (for v4->v6 and v6->v4 translation, respectively) the 
pseudo-header checksum by only looking at that one packet.

> similar case for UDP packet with checksum 0. Is my understanding

The UDP with zero checksum is much different, because it requires a 
computation of the checksum for the whole datagram i.e. across all the 
fragments.

    Erik

---

From: Francis Dupont <[email-masked]>
Date: Tue, 06 Dec 2005 01:41:28 +0100

In your previous mail you wrote:

=> I agree: the checksum is adjusted and not recomputed. Usually
the address part is cached in the mapping, and when you can choose
one part of an address you even try to make the update null.

=> note zero checksum UDPs should only occur in cases where they are
small enough to be never fragmented, i.e., UDP checksums are highly
recommended in NFS & co, DNS including EDNS0, but not for video
or voice where large packets and fragmentation add too much delay.

Regards

[email-masked]