Re: [v6ops] Some stats on IPv6 fragments and EH filtering on the Internet

[Ronald Bonica <[e-mail]>]

Brian,

I see your point. If we fix the problems associated with extension headers, people will configure their middle-boxes to allow them. So, if we repeat Fernando's experiment in a few years, we may see very different results. 

You say that there are three distinct problems. I am aware of the following:

- the tiny fragment problem (addressed by draft-ietf-6man-oversized-header chain)
- the long header chain problem (addressed by draft-kumari-6man-long-headers)

What is the third problem?

                                              Ron


> -----Original Message-----
> From: Brian E Carpenter [mailto:[e-mail]]
> Sent: Monday, November 18, 2013 11:35 PM
> To: Ronald Bonica
> Cc: Fernando Gont; [e-mail]; IPv6 Operations
> Subject: Re: [v6ops] Some stats on IPv6 fragments and EH filtering on
> the Internet
> 
> On 19/11/2013 10:50, Ronald Bonica wrote:
> > Folks,
> >
> > Fernando presents two studies in <http://www.iepg.org/2013-11-
> ietf88/fgont-iepg-ietf88-ipv6-frag-and-eh.pdf>. The second study is
> more interesting to me, because duplicate addresses are removed.
> >
> > The following are a few questions regarding Fernando's second study:
> >
> > 1) Fernando observes that 41% of sites discard fragmented packets.
> However, in a similar study
> (http://www.nlnetlabs.nl/downloads/publications/pmtu-black-holes-msc-
> thesis.pdf) only 10% of sites discarded fragmented packets. I wonder
> why the two studies yield such divergent results.
> 
> Well, that depends on whether there are significant differences between
> the observation points and/or the set of target sites for the two
> studies. There's certainly no law of physics that prevents both
> measurements being correct.
> 
> > 2) Fernando observes that 44% of sites discard packets containing an
> 8 byte destination header, while 89% of sites discard packet containing
> 1 kilobyte of extension headers. Because the first number (44%) is so
> high, can I conclude that the second (89%) is insignificant.
> 
> > Could it be that extension header length is a non-issue, because so
> many sites filter packets containing extension headers, regardless of
> their length?
> 
> I don't think so. We've just agreed on an update to RFC 2460 that, if
> it is adopted by middleboxes, will fix or at least clarify the issue of
> what happens to short extension headers. We need to wait a few years to
> see if that happens, of course. That seems to me to be quite disjoint
> from the issue of whether boxes that inspect extension headers have big
> enough buffers, and distinct again from whether they handle fragmented
> headers. I think there are three problems, needing three solutions.
> 
>    Brian
>                                                           Ron
> >
> >> -----Original Message-----
> >> From: [e-mail] [mailto:[e-mail]] On Behalf
> >> Of Fernando Gont
> >> Sent: Monday, November 04, 2013 6:02 PM
> >> To: [e-mail]; IPv6 Operations
> >> Subject: Some stats on IPv6 fragments and EH filtering on the
> >> Internet
> >>
> >> Folks,
> >>
> >> I did a presentation on the topic at the IEPG meeting earlier this
> >> week.
> >> It provides some concrete data regarding IPv6 fragmentation and
> >> Extension Header filtering on the Internet.
> >>
> >> The slideware is available at:
> >> <http://www.iepg.org/2013-11-ietf88/fgont-iepg-ietf88-ipv6-frag-and-
> >> eh.pdf>
> >>
> >> Certainly there's *much* more work to be done in this area, but I
> >> thought that this could be good food sfor some of the discussions
> >> that we were having on the topic.
> >>
> >> Thanks,
> >> --
> >> Fernando Gont
> >> e-mail: [e-mail] || [e-mail] PGP
> Fingerprint:
> >> 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1
> >>
> >>
> >>
> >> --------------------------------------------------------------------
> >> IETF IPv6 working group mailing list
> >> [e-mail]
> >> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> >> --------------------------------------------------------------------
> >>
> >
> >
> > _______________________________________________
> > v6ops mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/v6ops
> >
>