Re: Non-Last Small IPv6 Fragments

> On 11 Jan 2019, at 8:44 am, Erik Kline <ek@loon.co> wrote:
> 
> On Thu, 10 Jan 2019 at 13:39, Simon Hobson <linux@thehobsons.co.uk> wrote:
>> 
>> Tom Herbert <tom@herbertland.com> wrote:
>> 
>>> That might be reasonable, however requiring intermediate fragments to
>>> be at least 1280 MTU in IPv6 also solves that without needing to
>>> define some aritrary new limit.
>> 
>> In setting a minimum payload size for a fragment, is there a risk of conflicting with some known, or future unknown, link type with a small MTU ?
> 
> Technically that link wouldn't meet the 1280 min mtu requirement for
> IPv6, right?
> 
> Even with 1280 byte min fragment sizes, a reassembly engine still
> probably needs to place some limits in practice on the resources it
> will devote to reassembly.  An attacker and sent 1280-sized fragments
> for an endless series of 65535-sized datagrams…

approximate packet counts.

65535/1280
51

65535/1500
43

or even

65535/640
102

but a IPv6 node doesn’t have to support reassembly up to 65535

If you are worried about too many fragments, count and limit the fragments
not the fragment size.  If you get too many fragments for a packet just
discard them all.

> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> ipv6@ietf.org
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742              INTERNET: marka@isc.org