Re: [tcpm] comments on draft-ietf-tcpm-icmp-attacks-05

[Joe Touch <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Fernando Gont wrote:
> Florian Weimer wrote:
> 
>>>> For instance, I'm not certain that setting the DF bit is only
>>>> possible for hosts that support PMTUD ... is there a reference for
>>>> that?
>>> What's the reason for setting the DF flag for IP packets carrying TCP
>>> segments if you don't implement PMTUD?
>> You don't have to put randomness into the IP ID field (at least in
>> theory; in practice, DF=1 packets get fragmented, too).
> 
> Yes, in theory. For instance, IIRC Linux used to zero the IP ID field
> when DF was set, but then backed-out this change.

This was/is also incorrectly done by some cellphones, to save state and
processing.

The trouble is that the IP ID is also used to detect (and discard)
duplicate segments. This is described in the draft I already cited, and
the best place to discuss it is the INT area mailing list.

Joe
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAko1uPUACgkQE5f5cImnZrsylgCdGfELd2eAxvVPtC/1wWigl1lY
8qwAoPStmplBwumSEldah/X3QLhY4VlP
=IP6g
-----END PGP SIGNATURE-----