5 ms·

The world did, then people came along and started blocking ICMP

corty 6y ago
Yes. There is a special circle in hell for braindead firewall admins filtering ICMP. Unfortunately happens often enough that "MTU problem" is the first thing that comes to mind at the grandparents description. Next in line would be "broken DNS"...
- deleted 6y ago
  [deleted]
- temp667 6y ago
  They are not braindead. ICMP used to be a bit broken and folks got sick of ping floods, sweeps, redirect attacks and tunneling hacks etc. Some pretty major places block ICMP as a result to keep their network reasoning and security analysis simpler.
  - korethr 6y ago
    Just because they are major places doesn't mean they are right or such practice buys any improvement in security worth the operational cost it imposes.
  - bcrl 6y ago
    ICMP ping of death was a thing in the 1990s. Those bugs have been fixed for more than 2 decades now.
  - viraptor 6y ago
    What do ping floods do that TCP syn floods don't? (I expect you run at least one service on the exposed hosts) Also what system even accepts ICMP based route redirects by default from the open internet?
korethr 6y ago
And when I am in my less charitable moods, I would claim that said people are unqualified to not just to configure networks, but to have opinions worth considering when it comes to setting network policy.
- tinus_hn 6y ago
  Unfortunately the only qualification required is for you to want to communicate with their network.
anticristi 6y ago
In my utopic world, we wouldn't need "ICMP won't fragment". IPv4/IPv6 would have the MTU of exactly 4096 bytes. Why not a higher or lower level protocol? Because this is the lowest level protocol which is end-to-end and has a path MTU. Lower level protocols would need to somehow handle the MTU and higher level protocols would need to fit their segments within the MTU. Why 4096? Because this is a common page size on computers. Multiple of this would likely bring little benefits, due to GRO/GSO. Also, it's my utopic world, so if you don't like it create your own. :))
- zamadatix 6y ago
  Not much of a utopia if all you do is say the same problem is now unsolved at a different layer ;). Nothing special about the layer below IP that allows it to fix the problem in a way IP couldn't be made to - it's just an annoying problem to fix efficiently.
- alerighi 6y ago
  4096 can be too much for unstable connections, for example Wi-Fi or mobile. Also, 4096 bytes at what level? Layer 2? And when you are using a tunnel, you add bytes and thus have to go higher than 4096 or go lower and reduce MTU, or fragment the packet to keep 4096 bytes. You are just raising the limit, not solving the problem.
- tinus_hn 6y ago
  This is the network version of ‘640k should be enough for anyone’. Don’t fixate this kind of policy in such a fundamental protocol.
- noselasd 6y ago
  The issue is how the network are glued together, your X MTU will be embedded in a VPN tunnel, PPPOE - and that device needs to tell your device about its MTU
- AlphaSite 6y ago
  How would this work for IP over IP networks?

Yes. There is a special circle in hell for braindead firewall admins filtering ICMP. Unfortunately happens often enough that "MTU problem" is the first thing that comes to mind at the grandparents description. Next in line would be "broken DNS"...

deleted 6y ago
[deleted]
temp667 6y ago
They are not braindead. ICMP used to be a bit broken and folks got sick of ping floods, sweeps, redirect attacks and tunneling hacks etc. Some pretty major places block ICMP as a result to keep their network reasoning and security analysis simpler.
- korethr 6y ago
  Just because they are major places doesn't mean they are right or such practice buys any improvement in security worth the operational cost it imposes.
- bcrl 6y ago
  ICMP ping of death was a thing in the 1990s. Those bugs have been fixed for more than 2 decades now.
- viraptor 6y ago
  What do ping floods do that TCP syn floods don't? (I expect you run at least one service on the exposed hosts) Also what system even accepts ICMP based route redirects by default from the open internet?

korethr 6y ago

And when I am in my less charitable moods, I would claim that said people are unqualified to not just to configure networks, but to have opinions worth considering when it comes to setting network policy.

tinus_hn 6y ago
Unfortunately the only qualification required is for you to want to communicate with their network.

anticristi 6y ago

In my utopic world, we wouldn't need "ICMP won't fragment". IPv4/IPv6 would have the MTU of exactly 4096 bytes. Why not a higher or lower level protocol? Because this is the lowest level protocol which is end-to-end and has a path MTU. Lower level protocols would need to somehow handle the MTU and higher level protocols would need to fit their segments within the MTU. Why 4096? Because this is a common page size on computers. Multiple of this would likely bring little benefits, due to GRO/GSO. Also, it's my utopic world, so if you don't like it create your own. :))

zamadatix 6y ago
Not much of a utopia if all you do is say the same problem is now unsolved at a different layer ;). Nothing special about the layer below IP that allows it to fix the problem in a way IP couldn't be made to - it's just an annoying problem to fix efficiently.
alerighi 6y ago
4096 can be too much for unstable connections, for example Wi-Fi or mobile. Also, 4096 bytes at what level? Layer 2? And when you are using a tunnel, you add bytes and thus have to go higher than 4096 or go lower and reduce MTU, or fragment the packet to keep 4096 bytes. You are just raising the limit, not solving the problem.
tinus_hn 6y ago
This is the network version of ‘640k should be enough for anyone’. Don’t fixate this kind of policy in such a fundamental protocol.
noselasd 6y ago
The issue is how the network are glued together, your X MTU will be embedded in a VPN tunnel, PPPOE - and that device needs to tell your device about its MTU
AlphaSite 6y ago
How would this work for IP over IP networks?