Subject: Re: Fragmentation-related security issues

From: RJ Atkinson <[email-masked]>
Date: Wed, 4 Jan 2012 08:55:13 -0500

Earlier, Doug Barton wrote:
> On 01/03/2012 11:02, Dan Wing wrote:
> > If IPv6 hosts don't handle
> > ICMP packet-too-big of less than 1280, those IPv4/IPv6 translators 
> > won't work with sub-1280 MTU IPv4 paths.
> 
> ... and this is not a feature because? And no, don't quote the
> robustness principle. The floor for MTU has been hard-coded since day 1,
> so anyone who breaks that deserves what they get.

In fact, the MTU floor CHANGED from 576 to 1280 well AFTER day 1,
as I noted in a separate note within the past day or so.
(If it had not changed, then I likely would not have
posted any notes in the past few days.)

Separately, I'm old enough to believe in the robustness
principle -- because Jon Postel's argument for it was 
(and remains) quite correct.

Cheers,

Ran

---

From: Doug Barton <[email-masked]>
Date: Wed, 04 Jan 2012 14:02:34 -0800

> In fact, the MTU floor CHANGED from 576 to 1280 well AFTER day 1,

Technically you're correct of course, but for all practical values of
"day 1" I think my point remains valid.

> (and remains) quite correct.

In the abstract, sure. But to what extent does that argument apply to
people who made a best effort at following the spec and didn't get it
done exactly the way that you did; and to what extent does it apply to
people who say "Screw the spec, I'm gonna do it this way, you sort it out."

Doug

-- 

	You can observe a lot just by watching.	-- Yogi Berra

	Breadth of IT experience, and depth of knowledge in the DNS.
	Yours for the right price.  :)  http://SupersetSolutions.com/