3 ms·

Dropping packets is not the whole story... > If you are dropping packets and losing data, why would it matter if you're making one request or several? Let's j

by m3047 1y ago

Dropping packets is not the whole story... > If you are dropping packets and losing data, why would it matter if you're making one request or several? Let's just focus on the second part: why would it matter if you're making one request or several? Because people make bad assumptions about the order that requests complete in, don't check that previous requests completed successfully, maybe don't know how (or care) because that's all buried in some frontend framework... maybe that's the point! > Believing that one request maps to one packet is a frequent "gotcha" I have to point out to new network devs. What is a "network dev"? Unless they're using UDP... maybe you're thinking of DNS? Nah probably not. QUIC? Is that the entire internet for you? Oh. What about encryption? That takes whole handshakes. Send one packet, recipient always receives one packet, is a "gotcha" I have to point out to experienced network administrators... along with DNS requires TCP as well as UDP these days, what with DNSSEC, attack mitigations, etc.

softfalcon 1y ago
Thank you for opening the can of worms. That was my goal when I asked this question! As for what am I thinking of? All of the above! They're all part of my day job for the software I build. Also, this isn't meant to be flippant, I agree with what you're saying! :D
- m3047 1y ago
  > This is because standard TCP packets max out at ~65 Kb. BTW, frags are bad. DNS infra is still kneecapped by what turned out to be an extremely exuberant kicking of the can down the road packaged as "best practice". I think the architectural discussion must have been "100 nameservers for an AD domain, plus AUTHORITY and ADDITIONAL, not to mention DNSSEC..." "Oh UDP is fine. Frags aren't a problem, the routers and smart NICs will handle it fine." "4096 ought to be enough for anybody." "Good. I'll have another Old Fashioned then." And then the clever attacks begin. Jumbos are great, but the PMTU has to support it. Localhost or a datacenter, maybe a local network. Somewhere between BIND 9.12.3 and BIND 9.18.21 the default for max-udp-size changed from 4096 to 1232. Just sayin....

by m3047 1y ago

softfalcon 1y ago

Thank you for opening the can of worms. That was my goal when I asked this question! As for what am I thinking of? All of the above! They're all part of my day job for the software I build. Also, this isn't meant to be flippant, I agree with what you're saying! :D

m3047 1y ago
> This is because standard TCP packets max out at ~65 Kb. BTW, frags are bad. DNS infra is still kneecapped by what turned out to be an extremely exuberant kicking of the can down the road packaged as "best practice". I think the architectural discussion must have been "100 nameservers for an AD domain, plus AUTHORITY and ADDITIONAL, not to mention DNSSEC..." "Oh UDP is fine. Frags aren't a problem, the routers and smart NICs will handle it fine." "4096 ought to be enough for anybody." "Good. I'll have another Old Fashioned then." And then the clever attacks begin. Jumbos are great, but the PMTU has to support it. Localhost or a datacenter, maybe a local network. Somewhere between BIND 9.12.3 and BIND 9.18.21 the default for max-udp-size changed from 4096 to 1232. Just sayin....