3 ms·
This seems like a really bad thing to do. If any of those reserved bits get used for a legitimate purpose in the future then none of these networks will be ac
by nly 11y ago
This seems like a really bad thing to do. If any of those reserved bits get used for a legitimate purpose in the future then none of these networks will be accessible. Reserved should mean "set to 0 when you send, ignore on when you receive". It's not like these bits actually cost any additional processing. There's literally no benefit to dropping these packets, and it's shenanigans like this that mean we can't improve protocols easily in the future.
I wonder how many routers are filtering IPv4 packets with fragment offsets of 8190 and 8191?
- fulafel 11y agoFirewalls and other middleboxes are notorious about doing very bad things like this to the detriment of the internet as a whole. See PMTU discovery, why it was impossible to deploy TCP RED or SCTP, etc.
- technion 11y ago"Windows DNS is broken" was a meme for about five years due to Cisco ASA's blocking EDNS traffic.
- arielb1 11y agoThis may be better than allowing the bit to desynchronise your firewall's state machine. However, if you want to be nazi like that you may actually prefer not to route your network to the Internet at the IP layer but rather provide application-level proxies (IIRC Check Point products can be configured like this).