Re: [v6ops] Some stats on IPv6 fragments and EH filtering on the Internet

[Nick Hilliard <[e-mail]>]

On 05/11/2013 09:59, Ole Troan wrote:
> it would be very interesting to know where filtering is done.
> my assumption is that it isn't done in what I call the Internet infrastructure,
> but close to the hosts (edge), or in the hosts themselves.
> 
> pretty tricky to measure that from afar though.

as Mike Abrahamsson said, if you have cisco sup720 (or anything with a
PFC3) in the path, then you have serious problems with frags.  As an
operator you need to make a decision between dropping all frags in hardware
(chassis-wide), passing all frags in hardware (chassis-wide, noting that
this removes control plane protection for v6 frags), or slow-pathing the
frags via the RP (thereby opening up the RP to being trashed).  From an
operational point of view there is really only one option.

You could say that this is an operator problem and they get what they
deserve for running equipment of this era, but realistically these devices
will be running on the internet until the heat death of the universe.

Nick