lkml.org 
[lkml]   [1999]   [Aug]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: IPSEC transport mode w/2.2.x kernels and large packets
    Date
    Hello!

    > Set the MTU to 64K
    > Set the MSS on the routers to the estimated path mtu

    Yup. And to add code to calculate MSS from estimated path mtu,
    taking into account IPsec overhead.


    > Now TCP generates frames the right size for optimal performance, everything
    > else hands down full datagrams and the world is a happier place.

    Alan, the world is not such happy place 8). IPv6 has no DF flag,
    so that path mtu discovery is not an option.


    > You can't run path MTU discovery with IPsec. The DF could be faked and aimed
    > at dropping your link to unusably low speeds. Ignoring the DF could equally
    > be a complete link failure. So you don't run mtu discovery.

    Path MTU discovery is run to IMPROVE things. If we do not use
    path MTU discovery we must use mtu of 576. The period.

    The only security problem of pmtu discovery is when someone
    blocks icmp. Well, it is curable. And if without IPsec we may
    blame on stupid network admins, blocking them, with IPsec we will
    have to work it around.

    Alexey

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:53    [W:0.019 / U:1.276 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site