3 ms·

I find it mildly embarrassing that people still manage to screw up PMTUD, a big CDN, no less ... but then again, I guess I appreciate that they did actually car

I find it mildly embarrassing that people still manage to screw up PMTUD, a big CDN, no less ... but then again, I guess I appreciate that they did actually care to fix it once they noticed, which is not something to take for granted, and at least it was not the idiotic idea of filtering ICMP (has Amazon ever managed to fix EC2?), but an actual oversight. However, that blog article seems somewhat misinformed: In addition to tunnels, one major reason for PMTUs smaller than the standard Ethernet MTU of 1500 are DSL connections based on PPPoE, both for IPv4 and for IPv6. The only reason most people don't notice the breakage caused by incompetent admins (in the let's filter ICMP case) is because home routers tend to mess with the TCP options in SYN packets, adding an MSS matching the MTU of the DSL connection. Of course, that's a braindead fix, as it doesn't work for anything other than TCP. BTW: I doubt it was that small a number of users that noticed, a customer of mine also noticed (native IPv6 over ADSL), but given that this usually is caused by intentionally clueless admins, I just told them that the server admin probably was incompetent rather than reporting the problem to cloudflare ...

majke 12y ago
[citation needed] But more seriously, PMTUD usually just works, so people tend to forget about it. This is actually good - it's a sign that things have stabilised. It's only the unusual setup at CloudFlare caused the problems, not problems with MTU itself. The world would be a better place if people understood how things they rely on work. That's I wrote this article.
- zAy0LfpBZLC8mAC 12y ago
  citation for what? ;-) That PMTUD just works is not my experience, especially with IPv4, there are lots of servers/sites out there that break if you don't mangle the MSS if you are behind some link with an MTU < 1500--unfortunately. But yeah, let's hope that your article will help spread the word that PMTUD is important, and that completely filtering ICMP is idiotic--in any case it has helped remove an "incompetent" flag for your company in my brain ;-)

majke 12y ago

[citation needed] But more seriously, PMTUD usually just works, so people tend to forget about it. This is actually good - it's a sign that things have stabilised. It's only the unusual setup at CloudFlare caused the problems, not problems with MTU itself. The world would be a better place if people understood how things they rely on work. That's I wrote this article.

zAy0LfpBZLC8mAC 12y ago
citation for what? ;-) That PMTUD just works is not my experience, especially with IPv4, there are lots of servers/sites out there that break if you don't mangle the MSS if you are behind some link with an MTU < 1500--unfortunately. But yeah, let's hope that your article will help spread the word that PMTUD is important, and that completely filtering ICMP is idiotic--in any case it has helped remove an "incompetent" flag for your company in my brain ;-)