Subject: RE: [tcpm] ICMP and TCP

From: "Bora Akyol" <[email-masked]>
Date: Fri, 19 May 2006 13:53:04 -0700

This is why security of PMTU should be solved at the IP layer,
don't you think?

> -----Original Message-----
> From: Templin, Fred L [mailto:[email-masked]] 
> Sent: Friday, May 19, 2006 11:31 AM
> To: Bora Akyol; [email-masked]
> Subject: RE: [tcpm] ICMP and TCP
> 
> Bora,
> 
> > 1) Path MTU, this is an IP layer functionality. TCP is just a
> bystander.
> 
> How can you expect the IP layer to implement robust Path MTU 
> when ICMP "packet too big" messages may be forgeries or 
> missing altogether? See:
> 
> http://www.ietf.org/html.charters/pmtud-charter.html
> 
> Fred
> [email-masked]
> 
> 

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: "Templin, Fred L" <[email-masked]>
Date: Fri, 19 May 2006 14:08:06 -0700

> This is why security of PMTU should be solved at the IP layer,

No; that would require the source system to have a security
association with every router on the path - unless you want
to ignore all "packet too bigs" that come from intermediate
nodes in which case you would black-hole.

As Matt Zekauskas said (and, as the icmp-attacks draft says),
if you want PMTU w/o ICMPs, you can get it using:

<http://www.ietf.org/internet-drafts/draft-ietf-pmtud-method-06.txt>

But, that method requires support from a packetization layer
(e.g., TCP).

Fred