Re: Treatment of ICMP for PMTU

[Magnus Westerlund <[e-mail]>]

Den 2018-07-03 kl. 01:19, skrev Lubashev, Igor:
>
>   * Probe starting at PTB_SIZE or verify Base_MTU and then probe up.
>     From my perspective, the important is that one uses this a signal
>     for checking the PMTU.
>
> From my perspective, there are two things that are important here:
>
>  1. Use PTB signal to start probing (as you said).  This is section 3.3.
>  2. Identify cases, when you can set PMTU to PTB_SIZE immediately upon
>     receipt of PTB, while the probing is happening.
>
Yes, that should definitely be detailed. For a validated message, I 
think there are good reasons to adjust PLPMTU to PTB_SIZE when it is 
less than PLPMTU and >= BASE_MTU. As this can prevent driving at least 
one additional RTT of data likely into a MTU blackhole. However, there 
are clearly corner cases, for example with inconsistent MTUs. But the 
goal there is to find the lower of the multiple thresholds.

> Plus one more thing that is not in that draft at all – I think it is 
> prudent to respect PTB, even if that PTB is not validated (i.e. w/o 
> on-path proof, using my lingo), if PTB_SIZE is large enough (to be 
> defined how large).  It probably deserves its own thread in tsvwg.
>

Definitely a TSVWG thread I think, please start a thread. I see 
significant issue with using unvalidated PTBs. First of all one need to 
be able to be certain that it is actually related to ones flow at all. 
Secondly, if it doesn't contain any information that one can identify it 
as an actually sent packet then one are open to off-path attackers. That 
is a real issue. I think at most one can initiate a probe based on flow 
related but not fully validated PTB messages.

Cheers

Magnus Westerlund

----------------------------------------------------------------------
Network Architecture & Protocols, Ericsson Research
----------------------------------------------------------------------
Ericsson AB                 | Phone  [phone]
Torshamnsgatan 23           | Mobile [phone]
SE-164 80 Stockholm, Sweden | mailto: [e-mail]
----------------------------------------------------------------------