3 ms·

>"I'm dealing with some of the 30+ year old broken stuff today..." I am curious which behaviors you are referring to. Can you elaborate? >"IP Fragmentation is

>"I'm dealing with some of the 30+ year old broken stuff today..." I am curious which behaviors you are referring to. Can you elaborate? >"IP Fragmentation is pretty awful. I wouldn't say it never worked, because I see some legitimate traffic using it." I am curious what types of traffic you you have that's doing IP fragmentation regularly?

toast0 8y ago
I'm trying to get data on clients with path MTU problems, with an eye toward fixing it through statistics; assuming I can only intervene on the server side, because the clients are on Android, so path mtu blackhole detection is there, but disabled (thanks Google), and you can't set any useful socket options from Java anyway. I work for a messaging service , but won't tell you which one. I first saw IP fragments when some nice people were doing charge reflection ddos against our www servers, but the reflector hosts were sending fragmented UDP responses, and also filtering the first fragment out (probably because the first fragment has the port number, and chargen is clearly bad, but their firewall didn't think to drop or reassemble fragments). Since fragment reassembly was a big performance problem, I thought maybe we could just disable it, but actually we see a trickle of fragments on legitimate connections. I didn't track it further than we can't turn it off, but we can set the reassembly buffer to be incredibly small, which was enough to weather the storm (and knowing we could turn it off in case of high fragmentation rate was nice too).
- bogomipz 8y ago
  Thanks for the response. Interesting, do you mean Android has PMTU detection disabled in that Google is filtering "fragmentation needed but DF bit set" ICMP replies? That would be very surprising for Google I would think. Or are you referring to something else?
  - toast0 8y ago
    Android either doesn't enable PMTU detection, or it's only enabled in recent versions, or it's configured such that it's not effective. I've seen pcaps with iOS devices doing it though. I don't think Google would intentionally filter out the ICMP fragmentation needed packets, but there are lots of problems actually getting them, between routers that drop packets without sending them, firewalls that drop all ICMP, and NAT devices that don't know how to direct them to the underlying client. Edit: sorry I really mean PMTU probing. If you got a connection, but no acks when you send a large packet, after a significant timeout, it's worth trying to send smaller packets, even if you didn't get an icmp that says you should.
    - bogomipz 8y ago
      Ah OK, interesting that this behavior exists in iOS as well. Thanks for the clarification. Cheers.

toast0 8y ago

I'm trying to get data on clients with path MTU problems, with an eye toward fixing it through statistics; assuming I can only intervene on the server side, because the clients are on Android, so path mtu blackhole detection is there, but disabled (thanks Google), and you can't set any useful socket options from Java anyway. I work for a messaging service , but won't tell you which one. I first saw IP fragments when some nice people were doing charge reflection ddos against our www servers, but the reflector hosts were sending fragmented UDP responses, and also filtering the first fragment out (probably because the first fragment has the port number, and chargen is clearly bad, but their firewall didn't think to drop or reassemble fragments). Since fragment reassembly was a big performance problem, I thought maybe we could just disable it, but actually we see a trickle of fragments on legitimate connections. I didn't track it further than we can't turn it off, but we can set the reassembly buffer to be incredibly small, which was enough to weather the storm (and knowing we could turn it off in case of high fragmentation rate was nice too).

bogomipz 8y ago
Thanks for the response. Interesting, do you mean Android has PMTU detection disabled in that Google is filtering "fragmentation needed but DF bit set" ICMP replies? That would be very surprising for Google I would think. Or are you referring to something else?
- toast0 8y ago
  Android either doesn't enable PMTU detection, or it's only enabled in recent versions, or it's configured such that it's not effective. I've seen pcaps with iOS devices doing it though. I don't think Google would intentionally filter out the ICMP fragmentation needed packets, but there are lots of problems actually getting them, between routers that drop packets without sending them, firewalls that drop all ICMP, and NAT devices that don't know how to direct them to the underlying client. Edit: sorry I really mean PMTU probing. If you got a connection, but no acks when you send a large packet, after a significant timeout, it's worth trying to send smaller packets, even if you didn't get an icmp that says you should.
  - bogomipz 8y ago
    Ah OK, interesting that this behavior exists in iOS as well. Thanks for the clarification. Cheers.