Re: FW: New Version Notification for draft-bonica-6man-frag-deprecate-00.txt

[Ray Hunter <[e-mail]>]

> Ronald Bonica <mailto:[e-mail]>
> 21 June 2013 21:12
> Ray,
>
> Joel has already responded regarding DNSSEC. However, I would like to
> add a word regarding PMTUD brokenness.
>
> If the bad operator behavior to which you refer is the filtering of
> ICMP PTB messages, that bad behavior will break IPv6 fragmentation to
> the same degree that it breaks PMTUD. So, keeping IPv6 fragmentation
> around won't help very much.
>
> Ron
>
I don't 100% agree. In the case that PMTUD is broken, there'd be nothing
to stop a current DNSSEC implementation from always assuming a default
path MTU of 1280, without awaiting confirmation from PMTUD, and
fragmenting the UDP packet pre-emptively [assuming fragmentation was not
equally broken along the path as ICMP PTB was].

Looking at the opposite case [PMTUD OK, fragmentation deprecated] if
there's no fragmentation header available, what's the point of a stack
implementing PMTUD at the network layer (for UDP), when the only action
it could then take AFAICS is to punt to the application anyway?

BTW I'm not per se anti your draft. It's radical, but I'd like to
explore the pros and cons further before taking a position.

regards,
RayH
>
>
>
>
> Ray Hunter <mailto:[e-mail]>
> 21 June 2013 19:03
> I have also read this draft.
>
> It mentions that DNSSEC will be impacted.
>
> What's the alternative if DNSSEC can't send multiple UDP fragments?
>
> Isn't expecting a busy DNS server to maintain TCP session state for
> every single query going to be prohibitively expensive?
> Leading to even bigger DoS worries than fragmentation apparently causes?
>
> Isn't using TCP for all DNS queries going to considerably slow down the
> name resolution process, which will impact all applications?
> (multiple RTT for the connection establishment and teardown if you clean
> up properly)
>
> Since PMTUD is also currently pretty broken in practice, also due to
> "Operator Behavior" and filtering of ICMPv6 in firewalls, doesn't this
> memo effectively state that IPv6 = 1280 octets?
>
> regards,
> RayH
> ------------------------------------------------------------------------