Re: Use cases for PMTUD and PLPMTUD (was: RE: 6MAN: Adoption call on draft-hinden-6man-rfc1981bis-01)

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, Michael Richardson writes:
> 
> Mark Andrews <[e-mail]> wrote:
>     >> Except for within well-managed administrative domains where
>     >> RFC1981-only > is sufficient. They do exist; I am typing this message
>     >> from within one righ t now.
>     >>
>     >> I'd expect 6man to produce protocols that work everywhere, rather than
>     >> just on some subset scearios...
> 
>     > RFC 1981 works for TCP unless you *deliberately* break it by dropping
>     > PTB as TCP retries.
> 
> Yes, and we know that many networks do this.
> 
> {It appears that the Linux IPv6 XFRM/NetKey IPsec stack also fails to send
>  PTBs when operating in one-arm router mode, but I haven't fully convinced
>  myself that this is where the failure is yet}
> 
>     > RFC 1981 does NOT work in general for UDP.  DNS/UDP is a perfect
>     > example as it is the responding server that get the PTB and the DNS
>     > client is trying multiple servers.  Often by the time the server is
>     > tried again especially when a server is anycast the MTU knowledge has
>     > been lost.
> 
> I didn't think PLPMTUD worked any better in this situation, or are I wrong he
> re?

Conceptually you do PLPMTUD by adjusting the EDNS UDP size advertised
in the query until you get a response.  This isn't strict PMTUD as
it also accounts for firewalls that are blocking fragments, firewalls
that still think DNS is limited to 512 byte UDP payloads.  Unfortunately
you only have about 3 seconds to do this all in as well as talking
to other servers.  The DNS doesn't have a way of signaling "fragment
at this size".

Named tracks successful answers/timeouts with different EDNS udp
sizes as well as the actual response sizes that have got through.

; [edns success/4096 timeout/1432 timeout/1232 timeout/512 timeout]

Too many timeouts with a particlar size and we stop offering a EDNS
UDP buffer of that size and fallback to the next break point.  These
values are set for 4in6/6in4 + a UDP header.  timeouts with a smaller
EDNS buffer size also count against larger sizes.

> i.e: both are broken for UDP, and in the DNS/UDP case, the server never
>      retransmits either... so absent using TCP, it will always just fail.

But the client re-queries leading to a re-transmission.
 
> --
> Michael Richardson <[e-mail]>, Sandelman Software Works
>  -= IPv6 IoT consulting =-
> 
> 
> 
> 
> --=-=-=
> Content-Type: application/pgp-signature; name="signature.asc"
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.12 (GNU/Linux)
> 
> iQEVAwUBVrduiYCLcPvd0N1lAQJ7RQf/bInuCsHmVH6AONDSavt/Ut1/xo0NdnRp
> 1vtfg2LwHG5cUJGNpHOdnlg0OdhIJS9KVYN6xP0FQqbfTq4E6zRpoBkw4kMFQFWK
> cYOe8MaXx4FJFWF6MWcugglhWRkFQeSaQyYcn0Odhmeoc7w2/ehlsTfuFNGCnpH9
> 2bJS2Og80JWMDy7Q95IL6JrsKE1/VDDLpJJkQTfqPboZ1BG5Vn6IlDUT+lEMsZly
> By2CSNBglAqVtU5fUPYCa6yCx92I2g8MYePqkjclN1dAlELhlOUllsrJ8F3kCuFs
> 4eT9yAOtU4W7tP/Ka3bBdJTRYnS31NXozgdIlPsnhZ7mXdrks1tQcg==
> =kitT
> -----END PGP SIGNATURE-----
> --=-=-=--
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]