[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: linux-ipsec: cornered: MTU and fragmentation bugs
- To: alan@lxorguk.ukuu.org.uk (Alan Cox)
- Subject: Re: linux-ipsec: cornered: MTU and fragmentation bugs
- From: "Derrell D. Piper" <ddp@network-alchemy.com>
- Date: Thu, 25 Mar 1999 09:40:56 -0800
- cc: gnu@toad.com (John Gilmore), linux-ipsec@clinet.fi, kml@nas.nasa.gov, ipsec@lists.tislabs.com, kaos@ocs.com.au, perk@watson.ibm.com, gswallow@indy.net, djskinna@bunkie.indy.net, win95netbugs-owner@lists.stanford.edu
- In-reply-to: Your message of "Wed, 24 Mar 1999 22:33:32 GMT." <m10PwDM-0007U1C@the-village.bc.nu>
- Sender: owner-ipsec@lists.tislabs.com
[ NOTICE! This list will be hosted at lists.tislabs.com as of March 26.
There is no need to resubscribe, if you are on the list, you will remain
on it. Just begin sending posts, and any administrative requests to
lists.tislabs.com as of now. List mail to tis.com will cease to be
delivered as of March 26, 1999. ]
> It isnt [sic] the products, its [sic] the morons who install them. They
> have basically made the internet a 1500 mtu fixed size network.
Indeed "they" have. When I first started living on an IPSec tunnel to my
house, I had to figure out why it was that I couldn't surf abcnews.com. Every
other site I tried worked fine, just not abcnews.com.
It turns out that they're sending full ethernet-sized MTU datagrams with DF
set on all their packets. Furthermore, they're clearly filtering all ICMP in
their boarder gateway router... Sigh.
We're just going to have to take the time to painfully educate these network
managers if we want to see IPSec widely deployed. Calling them morons, while
perhaps accurate, isn't going to fix the problem. :-)
Derrell
References: