On Wed, Nov 08, 2006 at 11:32:44PM +0900, Izumi Tsutsui wrote:
> mouse@Rodents.Montreal.QC.CA wrote:
> 
> > > (I'm not sure if there is any protocol other than ICMP which could
> > > generate 21 or 22 byte IP fragment packets)
> > 
> > A UDP packet ever so slightly larger than your MTU can do it, surely?
> 
> Hmm, is there any actual protocal which could create
> "slightly (i.e. 1 or 2) larger than our MTU"?

Yes.  IKE runs over UDP and can embed certificate data which can be of
arbitrary length.

> If anyone could implement apps which will create
> such short UDP fragment packet, should we add workaround
> of the hardware ip4csum-tx bug on ex(4) after all?

Yes.