Re: OT: TCP/IP vulnerability

From: Ullrich von Bassewitz (uz_at_musoftware.de)
Date: 2005-04-19 14:23:28

On Mon, Apr 18, 2005 at 01:24:16PM +0200, Spiro Trikaliotis wrote:
> Because of this, many modern routers ignore the DF bit and never
> fragment. Furthermore, many computers always set the DF bit, resulting
> in the same.

There is no RFC that allows routers to just ignore the DF bit. Even more: the
RFCs do explicitly require that new equipment must handle older behaviour
well. Since path mtu discovery was not in the original TCP spec, such routers
would not work with older or simpler equipment. Do you know an example of a
router that does ignore DF by default?

> On the PPPoE line, the client (the station where my webbrowser or the
> like runs on) gets the ICMP packet. Unfortunetely, the server never sees
> it. Thus, it sends me datagrams which are too big for my line, and I
> never see these. Thus, I cannot communicate with that server.

Ok you're right with this one: If the server sets the DF bit, it must honour
the corresponding ICMP "fragmentation needed but DF bit set" messages.

> By contrast, the other solution ("clamping" the mtu size on the PPPoE
> router) used nowadays is a very bad one, as it requires the router to
> modify a datagram, something which is not allowed by the TCP protocol.

Better: Your host should not send large packets at all. Or: The router must
fragment. There are several solutions for the problem.

Regards


        Uz


-- 
Ullrich von Bassewitz                                  uz@musoftware.de

       Message was sent through the cbm-hackers mailing list

Archive generated by hypermail pre-2.1.8.