Re: [tcpm] comments on draft-ietf-tcpm-icmp-attacks-05

[Fernando Gont <[e-mail]>]

Eddy, Wesley M. (GRC-MS00)[Verizon] wrote:

>>> For
>>> instance, I'm not certain that setting the DF bit is
>>> only possible for hosts that support PMTUD ... is there
>>> a reference for that?
>> What's the reason for setting the DF flag for IP packets carrying TCP
>> segments if you don't implement PMTUD?
> 
> I know of a number of embedded OS kernels and real-time systems
> that either don't implement IP reassembly or disable it.  Some
> of the stacks geared towards real-time will also set DF on the
> packets that they send as the frag/reassembly is presumed to be
> an impediment to guaranteeing their delay bounds.

What do these systems do when they receive a "frag needed" ICMP error
message? If they adapt the segment size, they implement some form of PMTUD.
If frag was needed (As indicated in the ICMP error message), and they
keep sending at the same segment size, the connection would time-out
(not good). If they don't do any of these, and follow RFC1122 instead,
they should reset the connection (not good, either).



>> The appendix was at some point part of the main text. I moved the text
>> into an appendix probably on request of somebody, but not because I
>> thought the text should be there. So I have no problem moving the
>> entirre appendix (or part of it) back into the main part of the
>> document.
> 
> Oh, I didn't realize we'd already juggled it around :).
> It makes sense to me to analyze the different message
> types this way as motivation for the recommendations on
> how to treat them, which is why I expected it to be in
> the body, but if there was already consensus to have it
> as an appendix, then that's fine too.

No, I don't think there was consensus to move that stuff to an appendix.
It was probably the result of me honoring a suggestion I had received
from some folk.

Thanks,
-- 
Fernando Gont
e-mail: [e-mail] || [e-mail]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1