Re: diffedge handling of fragments

Michael Richardson <mcr@sandelman.ottawa.on.ca> Wed, 06 October 1999 22:55 UTC

Received: from lists.tislabs.com (portal.gw.tislabs.com [192.94.214.101]) by mail.imc.org (8.9.3/8.9.3) with ESMTP id PAA00265; Wed, 6 Oct 1999 15:55:20 -0700 (PDT)
Received: by lists.tislabs.com (8.9.1/8.9.1) id RAA28507 Wed, 6 Oct 1999 17:32:48 -0400 (EDT)
Message-Id: <199910062127.RAA04086@pzero.sandelman.ottawa.on.ca>
To: Sumit Vakil <sumit@calynet.com>
cc: ipsec@lists.tislabs.com
Subject: Re: diffedge handling of fragments
In-reply-to: Your message of "Wed, 06 Oct 1999 12:09:38 PDT." <636C2D109E6CD3119C3600062905FE8F8D45@MAIL-CLUSTER.calynet.com>
Mime-Version: 1.0 (generated by tm-edit 7.108)
Content-Type: text/plain; charset="US-ASCII"
Date: Wed, 06 Oct 1999 17:27:49 -0400
From: Michael Richardson <mcr@sandelman.ottawa.on.ca>
Sender: owner-ipsec@lists.tislabs.com
Precedence: bulk

>>>>> "Sumit" == Sumit Vakil <sumit@calynet.com> writes:

    Sumit> Michael, Section 4.4.2 of RFC 2401 also says that if the port
    Sumit> information is not available in a fragment it is to be discarded.
    Sumit> The exact text is as follows:

    Sumit> If the packet has been fragmented, then the port information may
    Sumit> not be available in the current fragment.  If so, discard the
    Sumit> fragment.  An ICMP PMTU should be sent for the first fragment,
    Sumit> which will have the port information.  [MAY be supported]

  Uh, I read this to be in the context of doing ICMP PMTU discovery for
the end hosts of the MTU of the tunnel. 

    Sumit> I'm not sure that sending a fragment over a host<->host SA would
    Sumit> always be the best course of action.  The host<->host SA might not
    Sumit> provide the required security for the fragment.

  Agreed.

] Train travel features AC outlets with no take-off restrictions|  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] mcr@sandelman.ottawa.on.ca http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another NetBSD/notebook using, kernel hacking, security guy");  [

diffedge handling of fragments mcr
RE: diffedge handling of fragments Sumit Vakil
Re: diffedge handling of fragments Michael Richardson
RE: diffedge handling of fragments Sumit Vakil