[157594] in North American Network Operators' Group
Re: IP tunnel MTU
daemon@ATHENA.MIT.EDU (Jeroen Massar)
Tue Oct 30 06:23:36 2012
Date: Tue, 30 Oct 2012 11:23:21 +0100
From: Jeroen Massar <jeroen@unfix.org>
To: Sander Steffann <sander@steffann.nl>
In-Reply-To: <40ADDAAF-102B-44A8-90B1-BA429FA1196D@steffann.nl>
Cc: NANOG list <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On 2012-10-30 11:19, Sander Steffann wrote:
> Hi,
>
>>>> Certainly fixing all the buggy host stacks, firewall and compliance devices to realize that ICMP isn't bad won't be hard.
>>>
>>> Wait till you get started on "fixing" the "security" consultants.
>>
>> Ack. I've yet to come across a *device* that doesn't deal properly with "packet too big". Lots (and lots and lots) of "security" people, one or two applications, but no devices.
>
>
> I know of one: Juniper SSG and SRX boxes used to block IPv6 ICMP errors when the screening option 'big ICMP packets' was enabled because it blocked all (v4 and v6) ICMP packets bigger than 1024 bytes and IPv6 ICMP errors are often 1280 bytes. I don't know if that has been fixed yet.
I do not see them "fixing" that either, if one misconfigures a host to
filter big ICMP packets, you get exactly that, it will filter those packets.
In the same way as folks misconfiguring hosts to drop ICMP in general etc.
One cannot solve stupid people as they will do stupid things.
Greets,
Jeroen
