UDP fragments , legitimate ?

UDP fragments , legitimate ?

[叶雨飞]

This is more like a general networking question

Is there legitimate use of UDP fragments in the wild? have you seen
commonly used application sending/receving UDP packets that is large
than MTU ? Is it safe to assume such traffic is nothing but dumb
attacks?

Thanks.

Re: UDP fragments , legitimate ?

[Brad Silva]

I know that NFS over UDP commonly sends packets that are much larger
than the MTU (as much as 32KB per).

However, it's very unlikely that you would see NFS outside your
firewall.  Also, most NFS these days is over TCP.

Brad

On Fri, Dec 14, 2012 at 12:06 PM, 叶雨飞 <sunyucong@gmail.com> wrote:
>
> This is more like a general networking question
>
> Is there legitimate use of UDP fragments in the wild? have you seen
> commonly used application sending/receving UDP packets that is large
> than MTU ? Is it safe to assume such traffic is nothing but dumb
> attacks?
>
> Thanks.
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>

Re: UDP fragments , legitimate ?

[Amos Jeffries]

On 15/12/2012 10:00 a.m., Brad Silva wrote:
> I know that NFS over UDP commonly sends packets that are much larger
> than the MTU (as much as 32KB per).
>
> However, it's very unlikely that you would see NFS outside your
> firewall.  Also, most NFS these days is over TCP.

HTCP protocol used by HTTP proxies to communicate between cluster peers 
can contain up to 64KB packets.

Amos

Re: UDP fragments , legitimate ?

[Michal Kubecek]

On Fri, Dec 14, 2012 at 12:06:12PM -0800, 叶雨飞 wrote:
> 
> Is there legitimate use of UDP fragments in the wild? have you seen
> commonly used application sending/receving UDP packets that is large
> than MTU ? Is it safe to assume such traffic is nothing but dumb
> attacks?

About one year ago I've seen (fragmented) aproximately 3KB packets of
JXTA protocol. But I have no idea how JXTA works so I don't know whether
this size is normal or just a result of their configuration.

                                                          Michal Kubecek

Re: UDP fragments , legitimate ?

[Eliezer Croitoru]

The basic answer for that is your network usage\users.
A UDP application shouldn't care about MTU since the data Is suppose to 
get from one end to the other.

Also notice that MTU size is not a must since there are also 
Jumbo-frames which are big and many OS can fragment a packet from 1500 
to 400 so this is not really something you can rely on.

If you have specific applications running in your environment you will 
have no problem testing it.

Eliezer

On 12/14/2012 10:06 PM, 叶雨飞 wrote:
> This is more like a general networking question
>
> Is there legitimate use of UDP fragments in the wild? have you seen
> commonly used application sending/receving UDP packets that is large
> than MTU ? Is it safe to assume such traffic is nothing but dumb
> attacks?
>
> Thanks.
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>