Subject: Re: DoS using crafted ICMP "frag needed" packets
To: Steven M. Bellovin <smb@cs.columbia.edu>
From: Jonathan Stone <jonathan@dsg.stanford.edu>
List: tech-net
Date: 06/22/2005 21:02:32
In message <E1DlGWd-0003Rm-00@smeg.dsg.stanford.edu>,Jonathan Stone writes:

>No, that's not what I'm getting at.  For the third time: I'm talking
>about probes sent *from* the remote TCP peer: periodic maximal-length
>segments sent *by* the remote TCP peer, in IPv4 datagrams with "DF" set.
>
>(Yes, well-behaved routers will send ICMP Fragmentation Requrired
>messages, if PMTU is exceeded; but that's not what I'm getting at;
>it's the PMTU probes themselves, if they make it to the remote TCP peer.)

D'oh.  It seems the heuristic I'd been thinking of, namely something like:

  ``If your TCP peer succeeds in sending you a bigger Dont-Fragmet
    segment than your idea of the PMTU, try probing for a larger PTMU
    [e.g., peer's reverse-path MTU?] now''

is apparently someone else's private hack.  (Obviously, a
router-initiated "fragmentation required but DF set" could be ignored
independently from snooping at possible reverse-mtu-probe traffic.
If one attempts the latter at all, that is)
 
Is the recommended probe-for-larger-PTMU interval still signficantly
larger than (2* maximum datagram lifetime) ?  10 minutes was a longer
interval than noticeable route-flaps, back around 1999 when I cared
enough to call Qwest (and get escalated to someone who knew what a
route-flap was) before the route became "good" again.