Re: [Int-area] WG Adoption Call: IP Fragmentation Considered Fragile

Joe Touch <> Fri, 31 August 2018 15:57 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 77B9C130E24; Fri, 31 Aug 2018 08:57:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.989
X-Spam-Status: No, score=-1.989 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_SPF_PERMERROR=0.01] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id uoXSaEL3I5fF; Fri, 31 Aug 2018 08:57:04 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id CD559130DD1; Fri, 31 Aug 2018 08:57:04 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;; s=default; h=To:References:Message-Id:Cc:Date:In-Reply-To: From:Subject:Mime-Version:Content-Type:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=BnyYaRW6a/oxIQV7e5N6BKMy2cqPpVQQYMKxJsrnvjo=; b=0YX4aqc+XHCTfSXnQi8n5a7na 2s0/DgH+4WTfZHS+IS7uRFN2z/E0pNjtEjUC+UXzZw25y4zzUyogX5ioCTBhSpTEtRjttKNjPU27i O+/qYujPSECFeZytuaxdhLKywwCen4fLXhgUngto34pCn4wLQ57k/454NMDp7E61pstaCXcsFBURV kV/KNynXdl/1yeyZFxXmu3XJ8kqIyrcucM3j6gRqNYbGNum3/JjnQciYd3hy5TZu4o+lONq9MuBpr phdysvBecTsry47BMNOHfzBrbrQxcjphehlLo5gbTjzTAGOhh3QL9KGhKvaqZRlZT63XJweWB5wSI 3AzEb6zDQ==;
Received: from ([]:62343 helo=[]) by with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.91) (envelope-from <>) id 1fvln7-002BYO-0g; Fri, 31 Aug 2018 11:56:58 -0400
Content-Type: multipart/alternative; boundary="Apple-Mail=_25C20CF7-6B1F-4080-A4A1-A9FA762C12A0"
Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\))
From: Joe Touch <>
In-Reply-To: <>
Date: Fri, 31 Aug 2018 08:56:55 -0700
Cc: Christian Huitema <>, Toerless Eckert <>, int-area <>,
Message-Id: <>
References: <> <> <> <> <> <> <> <> <> <> <> <> <> <> <> <> <> <> <>
To: Tom Herbert <>
X-Mailer: Apple Mail (2.3445.9.1)
X-OutGoing-Spam-Status: No, score=-1.0
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname -
X-AntiAbuse: Original Domain -
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain -
X-Get-Message-Sender-Via: authenticated_id:
X-From-Rewrite: unmodified, already matched
Archived-At: <>
Subject: Re: [Int-area] WG Adoption Call: IP Fragmentation Considered Fragile
X-Mailman-Version: 2.1.27
Precedence: list
List-Id: IETF Internet Area Mailing List <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 31 Aug 2018 15:57:07 -0000

> On Aug 31, 2018, at 8:44 AM, Tom Herbert <> wrote:
> Joe,
> There is an alternative: don't use NAT!

Agreed - that should also be part of the observations of this doc.

>> Yes, something needs to be done, but I argue that *until we have a worked
>> alternative*, we need to keep restating the fact - NATs/firewalls MUST
>> reassemble to work properly; where they don’t, the error is on them - not
>> the rest of the Internet for using fragments.
> Reassembly could only be a MUST for NAT, not firewalls.

“or its equivalent"

> NAT might be
> required because of the identifier space issue, however we already
> shown how a firewall can achieve proper functionality without
> reassembly and to be stateless by forwarding fragments and potentially
> dropping the first one that contains port information being filtered.

First, firewalls that port-filter need to do the same thing as a NAT in terms of keeping state.

> The fact that this might forward fragments that are never reassembled
> is at best an optimization with unproven benefit.

ATM proved otherwise in numerous published studies in the late 1980s. Those fragments compete for bandwidth further along the path; anytime they “win”, that decision is not work-conserving.

Note that keeping some state is already needed (if port-filtering) and that - as you note - the state filtering need not be “perfect”. However, it really ought to be SHOULD at least.

> There is another case where in-network reassembly could be required
> which is load balancing to a virtual IP address. 

Any middlebox that uses state not available in all fragments MUST reassemble or keep equivalent storage/state to process fragments appropriately.

> Like NAT though, in the long run I believe IPv6 offers a better
> solution that would eliminate the need for VIPs.

That’s true right up until we end up in a world where (mostly) nobody correctly uses flow IDs. Oh, wait - we’re already there…