Re: Question on TCP MSS with repsect to IPSEC

[Phil Karn <karn@unix.ka9q.ampr.org>]

>Doesnt the ICMP message indicate the datagram size (IP Header + data) that
>it can send? This being the case, the router or tunnel end point may not
>take into account the overhead of IPSEC, correct?

Well, that's how Path MTU discovery works -- it relies on the MTU
fields in the ICMP messages that bounce back when a packet is too
large to fit and the don't-fragment bit is set. When an IPSEC gateway
generates such an ICMP message for a destination on the other end
of a tunnel, this field should indeed be adjusted to compensate for
the IPSEC overhead. That should cause the original sender to adjust
its MSS appropriately, just as it would if IPSEC weren't in use.

Phil

---

References:

• Re: Question on TCP MSS with repsect to IPSEC
• From: Naganand Doraswamy <naganand@ftp.com>

---

• Prev by Date: Re: DNSSEC for IPSEC? -- or, how to exploit DNSSEC
• Next by Date: I-D ACTION:draft-ietf-ipsec-skip-udh-01.txt
• Prev by thread: Re: Question on TCP MSS with repsect to IPSEC
• Next by thread: Re: Question on TCP MSS with repsect to IPSEC
• Index(es):
  • Main
  • Thread