Re: [tsvwg] Status of ECN encapsulation drafts (i.e., stuck)

Bob Briscoe <> Sun, 15 March 2020 10:50 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 777083A1413 for <>; Sun, 15 Mar 2020 03:50:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id fELPjTnGEc82 for <>; Sun, 15 Mar 2020 03:50:47 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 908753A1415 for <>; Sun, 15 Mar 2020 03:50:47 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;; s=default; h=Content-Type:In-Reply-To:MIME-Version:Date: Message-ID:From:References:Cc:To:Subject:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=L38Uiqt9EH2tBEPpDdHCmJwfMqN882/hf5b2uK3sfKI=; b=w3iHCX6g0ZybZtCFJJjapZoPv Rpb1vb1JpmPghSAscHyOaeNpDgtp14QlYOXVIO3UQnC4H8Wqsy/VYIINrWT/S7Jaowib8hDrjc0IO nWq+Rn7eKKzrTpbfcjwuY+iXyN4d7fgG2kOZ6g+2+X2TAjeKpod/siuhjVsGveGPjyQdm9px9oBnR MhMC4V3IVyJNlLSf9g26BMCJwbxyj8AvptrfXg4JZ02TVgsfZpwWGASvwKYEV3Yyo2YITw9Gk75j1 ly1Nch04NvwD8GQHfnhV7t2No4ARxFkbcYTDSxL872NuUxP6Zj0hN9KZISlKtsqqUyU+fSWmkXdi+ X4W6vhLtw==;
Received: from [] (port=39502 helo=[]) by with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from <>) id 1jDQqz-001vyp-Mh; Sun, 15 Mar 2020 10:50:45 +0000
To: "Rodney W. Grimes" <>
Cc: Sebastian Moeller <>, "" <>
References: <>
From: Bob Briscoe <>
Message-ID: <>
Date: Sun, 15 Mar 2020 10:50:44 +0000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1
MIME-Version: 1.0
In-Reply-To: <>
Content-Type: multipart/alternative; boundary="------------5DBE1BB088E022D77CC2D9CF"
Content-Language: en-GB
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname -
X-AntiAbuse: Original Domain -
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain -
X-Get-Message-Sender-Via: authenticated_id:
Archived-At: <>
Subject: Re: [tsvwg] Status of ECN encapsulation drafts (i.e., stuck)
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Transport Area Working Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sun, 15 Mar 2020 10:50:50 -0000


On 14/03/2020 22:18, Rodney W. Grimes wrote:
> Bob,
> 	Questions and comments in line.
>> Finding the best max packet size is an area where neither IPv4 nor IPv6
>> has ever found a good solution. Getting a tunnel to fragment and
>> reassemble is indeed painfully sub-optimal, but all the other solutions
>> have their own problems. It is possible the sub-optimality is often
>> going on under-the-covers, just because it works. I do know that, for
>> IPv4, the Don't Fragment (DF) flag is often ignored by tunnels, as a
>> preferable alternative to just ditching the traffic.
> What do you base your "know" on?
> Can you please site an implementaiton?

Here's a selection of implementations that allow you to configure 
clearing the DF flag in order to allow fragmentation prior to encapsulation:

  * Cisco IOS:
  * Juniper JunOS:
  * Huawei:
  * Ericsson Redback:
  * Linux: iptables -t mangle -A PREROUTING -j DF --clear

While searching, I also found clear-df by accident in a firewall manual 
(not even doing any tunnelling)

And I even discovered "clear-df" in an (expired) individual Internet 
Draft from Ericsson for the Yang data model of an IPv4 tunnel:

Note, these are not to be confused with suppressing propagation of DF=1 
from the arriving IP header to the outer (so that a downstream router 
within the tunnel is allowed to fragment). In Linux, that would be: 
iptables -t mangle -A POSTROUTING -j DF --clear

So yes, I know this is often done, but I don't know how often.


Bob Briscoe