Subject: Re: DoS using crafted ICMP "frag needed" packets
To: Jonathan Stone <jonathan@dsg.stanford.edu>
From: Steven M. Bellovin <smb@cs.columbia.edu>
List: tech-net
Date: 06/22/2005 16:39:22
In message <E1Dl9dE-0007hS-00@smeg.dsg.stanford.edu>, Jonathan Stone writes:
>
>In message <20050622030411.696603BFECD@berkshire.machshav.com>"Steven M. Bello
>vin" writes
>
>>In message <E1DkuEo-0006sh-00@smeg.dsg.stanford.edu>, Jonathan Stone writes:
>
>>>A nice reponse. But what's the impact on PMTU discovery, specifically
>>>in the case that path-PMTU increases?  Isn't the required PMTU-probe
>>>behaviour in that case exactly the scenario (remote peer sends "DF"
>>>segment with a lenght larger than the current mtu) which you propse to ignor
>e?
>>>
>>>Or maybe not, I haven't read that RFC in some time....
>>>
>>
>>No, you never get such messages from remote routers; 
>
>Where did remote routers come into the picture? I was thinking of
>remote (TCP) peers; specifically after the path (or maybe even
>remote-peers outbound interface and thus first-hop MTU?) has changed,
>increasing PTMU. We don't want to ignore real MTU increases.
>

PMTU is from routers; it's not related to the remote window or maximum 
segment size.

		--Steven M. Bellovin, http://www.cs.columbia.edu/~smb