Subject: RE: [Ietf-behave] UDP packet fragmentation

From: "Dan Wing" <[email-masked]>
Date: Tue, 14 Sep 2004 12:31:13 -0700 (PDT)

I agree that encouraging PMTUD is the way to to.  Which means we
need to ensure BEHAVE requires NATs to handle those ICMP messages
correctly.

I'm hoping to get some suggested text out later today on ICMP.

-d

> -----Original Message-----
> From: Harald Welte [mailto:laforge@xxxxxxxxxxxx]
> Sent: Tuesday, September 14, 2004 12:15 PM
> To: Cullen Jennings
> Cc: Dan Wing; Francois Audet; Behave
> Subject: Re: [Ietf-behave] UDP packet fragmentation
>
>
> On Tue, Sep 14, 2004 at 10:09:59AM -0700, Cullen Jennings wrote:
> >
> > In the case where some fragment other than the first arrives before the
> > first fragment, I'm not sure I like the idea that the NAT
> should save the
> > fragments and send them later. It seem like it would be really
> complicated
> > to correctly do the memory management to make this work reliably and not
> > have a huge DOS opportunity.
>
> I agree that this can be problematic on very small devices.
>
> JFYI: Linux NAT actually uses the same defragmentation code as for local
> sockets, so the same limitations (maximum number of queued fragments at
> any given time, ...) apply.
>
> Encouraging the use of UDP PMTU discovery is the way to go.
>
> Any reasonably configured packet filter will drop inbound fragments
> anyway... too much DoS-capability, too many fragment-based attacks...
> And recently due to 16bit fragID wrapping on links with large bandwith
> even unnoticed data corruption... (seen a lot with fragmented NFS over
> UDP these days).
>
> > Cullen
> --
> - Harald Welte <laforge@xxxxxxxxxxxx>
http://www.gnumonks.org/
============================================================================
Programming is like sex: One mistake and you have to support it your
lifetime