4 ms·
I've played around with jumbo frames in the past. One issue is that none of the checksums at any layer were designed for packets this big. Both the Ethernet and
by mprovost 5y ago
I've played around with jumbo frames in the past. One issue is that none of the checksums at any layer were designed for packets this big. Both the Ethernet and TCP checksums don't have enough bits to reliably detect errors, even on 9k frames. This is ok if you're doing checksumming at the application layer, but often you're not, maybe it's something like NFS that assumes lower levels of the stack take care of message integrity. As transmission speeds have gone up, the bit error rate has stayed the same, so you can just do the math on how many errors you're going to have per day.
- brohee 5y agoThe NFS WG was adding Integrity Measurement Architecture that would address that and more, but the effort seems to have fizzled out, i assume COVID didn't help. https://datatracker.ietf.org/doc/html/draft-ietf-nfsv4-integrity-measurement-08 https://datatracker.ietf.org/doc/html/draft-ietf-nfsv4-integ...
- touisteur 5y agoThat's actually a very interesting observation. How much bits should a checksum take for such payloads? At least the 9000 jumbo things.
- mprovost 5y agoiSCSI uses a 32 bit CRC. (TCP is 16 bits). There was a draft to use 32 bit TCP checksums but it never got traction: https://datatracker.ietf.org/doc/html/draft-ietf-tcpm-anumita-tcp-stronger-checksum https://datatracker.ietf.org/doc/html/draft-ietf-tcpm-anumit...
- rjsw 5y agoSCTP uses a 32 bit checksum.
- Sesse__ 5y agoYou need to have application-level checksums anyway, since pretty much every router or switch these days will recalculate checksums on all layers (they need to if routing the packet, and since pretty much all COTS chipsets can do L3, they do so all the time even if the switch's software won't let you configure it), so if a bit flips in any router's processing, your checksums won't detect it.
- mprovost 5y agoSure but that means rewriting every application. There was a mind blowing Defcon presentation a few years ago "Bit-squatting: DNS Hijacking Without Exploitation" by Artem Dinaburg where they registered a bunch of domains that were one bit off from well known cloud providers, and recorded all of the requests that leaked out of their internal networks when the DNS response had a bit flipped. That's not to say that you're going to have a huge DNS response, but there is already some amount of this going on at every level of the stack and unless you rewrite every application from DNS on up to check then you're still going to encounter errors.
- Sesse__ 5y agoWell, use TLS and every TCP-using application is already secured.
- deleted 5y ago[deleted]