[157053] in North American Network Operators' Group
Re: Dropping IPv6 Fragments
daemon@ATHENA.MIT.EDU (joel jaeggli)
Thu Oct 4 11:28:40 2012
Date: Thu, 04 Oct 2012 08:27:41 -0700
From: joel jaeggli <joelja@bogus.com>
To: "Dobbins, Roland" <rdobbins@arbor.net>
In-Reply-To: <738A1605-76E7-4A3E-B42B-CEE26A0A7E09@arbor.net>
Cc: NANOG list <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On 10/4/12 8:15 AM, Dobbins, Roland wrote:
> On Oct 4, 2012, at 9:58 PM, joel jaeggli wrote:
>
>> Likewise with the acl I have the property that the initial packet has
>> all the info in it while the fragment does not.
> For iACLs, just filter non-initial fragments directed to infrastructure IPs. Cisco & Juniper ACLs have ACL matching criteria for non-initial fragments.
Yeah, that's more or less what we said in RFC 6192.
That said as the network operator of a content provider I have more
devices in my portfolio than just backbone routers.
>
> -----------------------------------------------------------------------
> Roland Dobbins <rdobbins@arbor.net> // <http://www.arbornetworks.com>
>
> Luck is the residue of opportunity and design.
>
> -- John Milton
>
>
>
