lkml.org 
[lkml]   [2000]   [Sep]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Elmer Joandi wrote:

> Alan Cox wrote:
>
> > > There are a -lot- of large sites that give us issues like this.
> >
> > So mail lots of people. Cisco are I think now aware that their firewall
> > products dont handle ECN correctly but others might not be.
> >
> > Or wait until more vendors roll out ECN
>
> There is another big problem like that...
> tunnels actually do not work on todays real internet...
> MTU 1500 is so much a standard that it starts killing tunnels.
> MTU < 1500 is not a working solution today thanks to (mostly
> linux based ? ) broken firewalls
>
> elmer.

The "broken" firewalls are those who block icmp naively. I use tunnels
great and the mostly perfect solution is to set the outbound route and
interface MTU to 1476. Works great lasts long time. And for the record
-every- time I have found a broken firewall dropping packets it has not been
a Linux based system.

Set your networking up right and it works right. People complain about
broken things but it almost always is poor understanding (mine included) of
how things work and having improperly set things up. True, documentation is
often sparse but we'll get there.

-d


--
"The difference between 'involvement' and 'commitment' is like an
eggs-and-ham breakfast: the chicken was 'involved' - the pig was
'committed'."


begin:vcard
n:Ford;David
x-mozilla-html:TRUE
org:<img src="http://www.kalifornia.com/images/paradise.jpg">
adr:;;;;;;
version:2.1
email;internet:david@kalifornia.com
title:Blue Labs Developer
x-mozilla-cpt:;28256
fn:David Ford
end:vcard
\
 
 \ /
  Last update: 2005-03-22 12:38    [from the cache]
©2003-2011 Jasper Spaans