[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Comments on latest IPSP drafts
>I suggest that there should be a discussion of the impact of IP
>fragmentation. In particular: (a) performance is affected since IP packets
>that already equal the MTU size will overflow with the addition of the AH or
>ESP data; (b) I think there should be an implementation note that the sender of
>an IPSP packet should make sure to put it through the fragmentation process,
>and the destination of an IPSP packet must reassemble it before processing the
>AH header or ESP payload.
In our prototyping of an IP security layer, we approached this by
having the sender's query for the MTU be intercepted by the security
layer, which subtracts the header lengths from the actual network MTU.
The sender thus learns how much payload is available. The
implementation of security as a layer makes the frag/reassembly
constraint natural and obvious.
References: