Subject: Re: DoS using crafted ICMP "frag needed" packets
To: Steven M. Bellovin <smb@cs.columbia.edu>
From: Jonathan Stone <jonathan@dsg.stanford.edu>
List: tech-net
Date: 06/22/2005 11:07:24
In message <20050622030411.696603BFECD@berkshire.machshav.com>"Steven M. Bellovin" writes

>In message <E1DkuEo-0006sh-00@smeg.dsg.stanford.edu>, Jonathan Stone writes:

>>A nice reponse. But what's the impact on PMTU discovery, specifically
>>in the case that path-PMTU increases?  Isn't the required PMTU-probe
>>behaviour in that case exactly the scenario (remote peer sends "DF"
>>segment with a lenght larger than the current mtu) which you propse to ignore?
>>
>>Or maybe not, I haven't read that RFC in some time....
>>
>
>No, you never get such messages from remote routers; 

Where did remote routers come into the picture? I was thinking of
remote (TCP) peers; specifically after the path (or maybe even
remote-peers outbound interface and thus first-hop MTU?) has changed,
increasing PTMU. We don't want to ignore real MTU increases.

But you're right: as I acknowledged before: I need to re-read
RFC-1191.  Pending me my doing my remedial homework, I'd prefer a
rate-limiting approach, rather than a strict drop/ignore policy.