Subject: [pmtud] Re: PMTU discovery for tunnels: issues 78, 49, 81

From: Michael Richardson <[email-masked]>
Date: Mon, 17 Nov 2003 10:19:06 -0500

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Yoav" == Yoav Nir <[email-masked]> writes:
    Yoav> For those of us who weren't there, can you please explain the 
    Yoav> situation?  What are the risks?

  I am not the best person to explain risk of PAWS with fragmentation.
  Matt said he would write something.

  Here is the summary of the discussion:

  Assume
      - very fast networks using large window TCP 
      - networks that connect them, with MTU constraints in them
      - that we ignore the DF bit and fragment anyway at the constraint,
	between dissimilar media. (9000 byte ethernet vs 1500 byte ethernet)
 
  Assume that a TCP segment gets fragmented into two pieces. The first
fragment gets lost. The second fragment stays in the end-host's queue.  Given
how fast the network is, it wraps the fragment ID several times a second. 

  So, a second packet gets fragmented in the same way, the first part arrives
and matches the queued fragment. The datagram is assembled, and if we are
lucky, it fails the TCP checksum. 
  The second part arrives, finds no first part and gets queued, and waits
for the next ID wrapping.

  However, given the speed of the connection, in short time, odds are the
TCP checksum will match, and the segment will get accepted. 

  If the PAWS does proper PMTU discovery, then this can't happen.

] Collecting stories about my dad: http://www.sandelman.ca/cjr/ |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian/notebook using, kernel hacking, security guy");  [

_______________________________________________
pmtud mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pmtud