Subject: Re: DoS using crafted ICMP "frag needed" packets
To: Steven M. Bellovin <smb@cs.columbia.edu>
From: Jonathan Stone <jonathan@dsg.stanford.edu>
List: tech-net
Date: 06/22/2005 18:29:03
In message <20050622203922.5F9713BFECD@berkshire.machshav.com>,
"Steven M. Bellovin" writes:


>PMTU is from routers; it's not related to the remote window or maximum 
>segment size.

Hi Steve,

No, that's not what I'm getting at.  For the third time: I'm talking
about probes sent *from* the remote TCP peer: periodic maximal-length
segments sent *by* the remote TCP peer, in IPv4 datagrams with "DF" set.

(Yes, well-behaved routers will send ICMP Fragmentation Requrired
messages, if PMTU is exceeded; but that's not what I'm getting at;
it's the PMTU probes themselves, if they make it to the remote TCP peer.)

I forget where I'm remembering these probes from, but it *does* exist.
Kevin Lahey's informational RFC, maybe, in the pmtu-blackhole-avoidance section?

Hmm, rfc2923 sec 2.1 does describe such probes, maybe that's it.