[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: Problem about reassembly and fragmentation



PMTU only applies in the case of DF bit set, right?

Why some application layer like NFS wants to send very large packets: NFS
version 2 can

send 8K size per message flow, NFS version 3 can send 32K bytes per message
flow. How PMTU

can handle this kind of cases?

-----Original Message-----
From: Stephen Kent [mailto:kent@bbn.com]
Sent: Monday, March 11, 2002 11:58 AM
To: Scott Fluhrer
Cc: ipsec@lists.tislabs.com
Subject: RE: Problem about reassembly and fragmentation


At 8:02 AM -0800 3/11/02, Scott Fluhrer wrote:
>At 06:11 AM 3/11/02 , Stephen Kent wrote:
>>
>>  [I]n transport mode, the packets received by an IPsec implementation for
>>  outbound processing ought not be fragments, otherwise the implementation
has
>>  to assemble them before applying IPsec. In tunnel mode, the IPsec
>>  implementation may receive fragments for outbound processing.  In either
>>  case, the addition of the IPsec headers may require exceed the MTU for
the
>>  outbound interface, so the "outer" header (the only header for transport
>>  mode) may exhibit fragmentation. I'd like to push for mandatory use of
PMTU
>>  and thus an ability to avoid the need to fragment, and perhaps 
>>avoid the need
>>  to perform reassembly at the receiver, to remove this means of DoS
attacks
>>  against receivers.
>
>
>While I appreciate your trying to allow a security gateway to avoid
>fragmentation, I doubt that it will always be practical in IPv4.  I have
seen
>networks where either:
>
>- The end application is too stupid to understand PMTU
>- There's a firewall between the security gateway and the end system which
>drops all ICMP messages
>
>In either of these cases, PMTU doesn't work.  And hence, we're either going
to
>stop supporting those legacy networks, or we're just going to allow
security
>gateways to fragment anyways.
>
>--
>scott

Scott,

I'm surprised that there are many OS instances today (it's not an 
application issue, right?) that still don't respond to PMTU.

As for the firewall problem, there is a complementary issue, 
firewalls and NAT devices that drop fragments, because they can't 
look at port fields.  We had a report at the last meeting of 
experience with NAT devices dropping fragments, which was causing 
problems for the UDP encapsulation strategy. Thus we may have 
problems in both cases and I'd argue for an approach that emphasizes 
MTU-based solutions to these problems, and a minimization of 
fragmentation on both sides of an IPsec implementation.

Steve