Re: [v6ops] Some stats on IPv6 fragments and EH filtering on the Internet

[Ole Troan <[e-mail]>]

Nick,

>> it would be very interesting to know where filtering is done.
>> my assumption is that it isn't done in what I call the Internet infrastructure,
>> but close to the hosts (edge), or in the hosts themselves.
>> 
>> pretty tricky to measure that from afar though.
> 
> as Mike Abrahamsson said, if you have cisco sup720 (or anything with a
> PFC3) in the path, then you have serious problems with frags.  As an
> operator you need to make a decision between dropping all frags in hardware
> (chassis-wide), passing all frags in hardware (chassis-wide, noting that
> this removes control plane protection for v6 frags), or slow-pathing the
> frags via the RP (thereby opening up the RP to being trashed).  From an
> operational point of view there is really only one option.
> 
> You could say that this is an operator problem and they get what they
> deserve for running equipment of this era, but realistically these devices
> will be running on the internet until the heat death of the universe.

yes, I should have included something about "barring software bugs".
if you use one of these in the Internet core I cannot see any other choice than to
allow forwarding of fragments. 

cheers,
Ole