From: Ralf Spenneberg <lists@spenneberg.org>
To: Abraham van der Merwe <abz@frogfoot.net>
Cc: Netfilter Discussions <netfilter@lists.netfilter.org>
Subject: Re: clearing dont-fragment bit
Date: 09 Oct 2003 19:12:51 +0200 [thread overview]
Message-ID: <1065719570.5873.31.camel@kermit> (raw)
In-Reply-To: <20031009165049.GA4043@oasis.frogfoot.net>
Am Don, 2003-10-09 um 18.50 schrieb Abraham van der Merwe:
> Hi Ralf >@2003.10.09_18:23:06_+0200
>
> > > Are there any iptables extensions out there that allow you to clear the DF
> > > (Dont Fragment) bit in ip headers?
> > If you clear the DF-Bit and use Linux on either side of the tunnel where
> > the packets are fragmented you are in deep trouble, because Linux 2.4
> > (when using PMTU) not only sets the DF-Bit but also clears the IP-ID
> > which is needed to defragment the packets again. So, when clearing the
> > DF-Bit you have to ensure unique numbers in the IP-ID field, too.
>
> Surely if I clear the DF-bit in the mangle table then the ipstack should
> only defragment the packet later on when it made a routing decision and
> decided over which interface to send the packet(s) and set the IP-ID fields
> and MF-bit accordingly?
Usually the IP-ID field is set by the sender and not by the router
fragmenting the packet. You have to set the IP-ID field and clear the
DF-Bit at the same time.
>
> Are there any other side-effects when clearing the DF-bit?
Only maybe the overhead when a fragment is lost.
Cheers,
Ralf
--
Ralf Spenneberg
RHCE, RHCX
Book: Intrusion Detection für Linux Server http://www.spenneberg.com
IPsec-Howto http://www.ipsec-howto.org
Honeynet Project Mirror: http://honeynet.spenneberg.org
next prev parent reply other threads:[~2003-10-09 17:12 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-10-09 13:43 clearing dont-fragment bit Abraham van der Merwe
2003-10-09 14:03 ` Maciej Soltysiak
2003-10-09 14:08 ` Abraham van der Merwe
2003-10-09 14:43 ` Ramin Dousti
2003-10-09 14:52 ` Abraham van der Merwe
2003-10-09 15:49 ` Ramin Dousti
2003-10-09 16:13 ` Abraham van der Merwe
2003-10-09 19:44 ` Ramin Dousti
2003-10-09 16:23 ` Ralf Spenneberg
2003-10-09 16:50 ` Abraham van der Merwe
2003-10-09 17:12 ` Ralf Spenneberg [this message]
2003-10-09 18:11 ` Abraham van der Merwe
2003-10-10 5:13 ` Ralf Spenneberg
2003-10-10 8:17 ` Abraham van der Merwe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1065719570.5873.31.camel@kermit \
--to=lists@spenneberg.org \
--cc=abz@frogfoot.net \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox