Subject: IPv6 and Tiny Fragments

From: "Vishwas Manral" <[email-masked]>
Date: Thu, 24 Nov 2005 21:10:47 -0800

Hi folks,

I have been wondering how IPv6 will deal with the tiny fragment attack,
RFC1858.

Is there a minimum non-last fragment size specified for IPv6? With so
many extension headers a size of around 80bytes IP Header+ payload may
not necessarily be right. 

I think, we could specify something closer to 200 bytes, which would
mean that we would certainly have the TCP header in the first fragment.

Thanks,

Vishwas

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Mohacsi Janos <[email-masked]>
Date: Fri, 25 Nov 2005 08:57:21 +0100 (CET)

> not necessarily be right.

It is defined to be larger than 1280 octets.

Janos Mohacsi
Network Engineer, Research Associate
NIIF/HUNGARNET, HUNGARY
Key 00F9AF98: 8645 1312 D249 471B DBAE  21A2 9F52 0D1F 00F9 AF98

---

From: Fred Baker <[email-masked]>
Date: Sat, 26 Nov 2005 20:13:44 -0800

personally, I think that would simply mean that the tiny fragment  
attack would come at that size.

Better to simply design TCPs well so that the attack is of minimal  
effect.

On Nov 24, 2005, at 9:10 PM, Vishwas Manral wrote:

> Hi folks,
>
>
>
> I have been wondering how IPv6 will deal with the tiny fragment  
> attack, RFC1858.
>
>
>
> Is there a minimum non-last fragment size specified for IPv6? With  
> so many extension headers a size of around 80bytes IP Header+  
> payload may not necessarily be right.
>
>
>
> I think, we could specify something closer to 200 bytes, which  
> would mean that we would certainly have the TCP header in the first  
> fragment.
>
>
>
> Thanks,
>
> Vishwas
>
>
>