Re: [v6ops] new draft: draft-taylor-v6ops-fragdrop

[Joe Touch <[e-mail]>]

On 10/31/2012 5:35 PM, Lorenzo Colitti wrote:
> On Thu, Nov 1, 2012 at 5:56 AM, Joe Touch <[e-mail]
> <mailto:[e-mail]>> wrote:
>
>     I'm wondering whether routers that drop fragments do so only when
>     that's the first option, or do they just drop packets with *any*
>     options?
>
>
> Routers just do what operators configure them to do.

Not everything; as you note below, some aspects of the configuration are 
limited by capability.

However, you've answered the key issue - this is not about fragments, 
but rather about two things:

a) DPI
	DPI cannot be done on packets with any options
	so this either means operators need to ignore DPI
	on such packets or drop them

There are certainly places where DPI is expected (e.g., by a 
government), and so only DPI-capable packets are permitted, but this 
doesn't seem tenable anywhere except at the boundaries of customer 
networks (otherwise all encrypted traffic would be dropped all over the 
place, and that doesn't appear to be happening)

b) support for ANY HBH options
	unfortunately, this is very difficult to determine
	unless fragmentation or a known destination option occurs

I.e., there's no structure to the option numbers that makes it easy to 
say "there are no more HBH options", so the best that can be done here 
is, as you note, "drop all packets with any options".

Again, however, that doesn't necessarily mean all remaining packets can 
be DPI processed.

Joe