2 ms·
Blocking ICMP tends to come with blocking ICMP Unreachables, that happens to handle Path MTU Discovery (PMTUD), which you definitely want on if you work around
by bastard_op 1y ago
Blocking ICMP tends to come with blocking ICMP Unreachables, that happens to handle Path MTU Discovery (PMTUD), which you definitely want on if you work around VPN's at all, or certain ISP's that might not allow a full 1500 byte frame. Microsoft loves to particularly set application traffic to Do-Not-Fragment, and this will play chaos on many Microsoft things if PMTUD is disabled around reduced MTU environments.
It's best left on at least inside a private/protected network.
- toast0 1y agoEverybody sets traffic to Do-Not-Fragment. Nobody wants their routers to fragment packets anyway; you might as well ask to get a notification when too big packets are dropped. Nobody wants to have their servers reassemble fragments, it's too much work; many servers just drop any fragments they do get. I ran servers pushing 20 gbps of downloads, and would receive on the order of two fragments per second. It looked legitimate, so I preferred not to disable fragment assembly, but I'd set the reassembly buffer as small as possible; there's no need to keep more than say 16 fragments... if you're getting more than a handful of fragments, it's ddos and that one guy with a weird network will just have to deal. They probably can't use any other sites anyway.