Re: [v6ops] Some stats on IPv6 fragments and EH filtering on the Internet

Jared Mauch <> Tue, 05 November 2013 15:30 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id F264311E80E6 for <>; Tue, 5 Nov 2013 07:30:56 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_31=0.6]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id zaLXnA3YNEE0 for <>; Tue, 5 Nov 2013 07:30:56 -0800 (PST)
Received: from ( [IPv6:2001:418:3f4::5]) by (Postfix) with ESMTP id A3A0311E80EC for <>; Tue, 5 Nov 2013 07:30:49 -0800 (PST)
Received: from [] ( []) (authenticated bits=0) by (8.14.7/8.14.5) with ESMTP id rA5FUhUn028251 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO); Tue, 5 Nov 2013 10:30:44 -0500
Mime-Version: 1.0 (Mac OS X Mail 7.0 \(1816\))
Content-Type: text/plain; charset=us-ascii
From: Jared Mauch <>
In-Reply-To: <>
Date: Tue, 5 Nov 2013 10:31:08 -0500
Content-Transfer-Encoding: quoted-printable
Message-Id: <>
References: <> <> <> <> <> <> <> <> <> <> <> <> <> <> <> <> <>
To: Brian E Carpenter <>
X-Mailer: Apple Mail (2.1816)
X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.1 ( []); Tue, 05 Nov 2013 10:30:44 -0500 (EST)
Cc: Fernando Gont <>, "" <>, Fernando Gont <>
Subject: Re: [v6ops] Some stats on IPv6 fragments and EH filtering on the Internet
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: v6ops discussion list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 05 Nov 2013 15:30:57 -0000

On Nov 5, 2013, at 10:21 AM, Brian E Carpenter <> wrote:

> On 06/11/2013 02:07, Nick Hilliard wrote:
>> On 05/11/2013 12:54, Ole Troan wrote:
>>> why don't you filter out packets on the edge destined to your router's addresses?
>>> instead of what's effectively breaking IPv6 service across the network.
>> you can use infrastructure acls if they are handled carefully and don't
>> depend on implicit "deny any any" (which has special handling for the
>> "platform ipv6 acl fragment hardware").  But in order to implement this you
>> need to protect every single link network connected to your PFC3s.  If your
>> addressing plan is designed with this in mind, it's feasible.  If you have
>> a very large network or if you've not handled your link address assignments
>> very carefully, it's often not practical because it means dynamically
>> maintaining huge access lists on every single device on the network.
> I think Homer Simpson has a word for this situation.
> We *really* aren't going to deprecate fragmentation because of one
> model of broken kit, are we?

I think the challenge here is that Cisco doesn't care to fix the problem
inherent in their software/hardware integration issue here.  There is no
structural correction of the defects in the software and nobody there takes
ownership to correct it.

I've sadly seen this play out time and time again without anyone fixing basic
infrastructure items that need correction.  They're unable to as it impacts
too many sub-platforms/internal consumers of the code that don't see the value
as it's not adding revenue.

Many of these headers (eg: hop-by-hop) are comparable to IPv4 features that
are ignored or dropped by firewalls and routers (Eg: source-route, ecn, etc).

Without an explicit standard that says things MUST be supported that we can
cite in RFP/RFI and broad coalition of purchasers it's difficult or impossible
to change things.  Places like Cisco are too big to steer and correct the
bad behavior.  I would love to be proven wrong, but years of experience tell
me it's not going to get better.

- Jared