Re: [Int-area] FW: Last Call: 'Fragmentation Considered Very Harmful' to Informational RFC (draft-heffner-frag-harmful)

[Joe Touch <[e-mail]>]

Matt Mathis wrote:
> On Fri, 13 Oct 2006, Joe Touch wrote:
> 
>>> (*mostly, because the other route is to strictly enforce the IP ID wrap time
>>> and fragment lifetimes.)
>> I'd prefer that approach to deliberately encourage breaking fragmentation.
> 
> let me get this straight: you would like to declare all IPv4 TCP
> connections running at full speed over fast Ethernet and faster to be
> protocol violations?  Some how I don't think others would agree.

Unless they stripe across separate IP addresses or ports, they are
violations of 791. We can change that, but we have not yet. Until we do,
it is a violation.

>>> (Ok one caveat: tunnels can also work if they greatly strengthen the IP ID
>>> and/or do their own fragmentation).
>> This is the bigger issue. Tunnels supposed to honor the DF bit, but
>> basically cannot. There are two alternatives:
>>
>> - clear DF in the outer header and take your chances
> 
> You missed my point (and part of why the problem space starts looking
> fractal).  If you think of the tunnel as a separate protocol that uses
> additional methods to protect itself from corruption (say by use of IPSEC, or
> an enhanced fragmentation mechanism, etc.) then it can be designed to support
> safe fragmentation.

That's basically what I said too.

> The fact that the payload is also IP packets which
> happen to be tagged DF, becomes irrelevant because they are not participating in
> the fragmentation itself.  They are just opaque payload data.  (Note that the
> tunnel should use it's own IPID space, not copied from the payload.)

That's true for the inner packet header, not the outer. The outer
defines how the tunnel works, and that's where fragmentation beyond the
tunnel head-end is problematic.

> There is not an easy way to detect if any particular combination of tunnel and
> endpoint features are safe, except to test if it fails with IPID=0.
> Unfortunately there are too many false fails to ship products in this
> configuration.

The issue of head-end fragmentation is independent from IPID=0; others
noted that this can be used for duplicate deletion in routers, so
flagging all your packets with the same ID is a good way to trigger
something (router, host) into thinking duplication is going on.

> One of the things I have musing about is writing a super jumbo tunnel protocol
> that would use its own fragmentation to put 64k IP jumbograms into 1500 byte
> IP packets with FEC (and without using IP fragmentation).   Think of the
> implications....

You'd have to fragment the jumbogram to do this, right?

Joe

_______________________________________________
Int-area mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/int-area