[58415] in North American Network Operators' Group
RE: PMTU and Broken Servers
daemon@ATHENA.MIT.EDU (Russell, David)
Mon May 12 16:40:24 2003
From: "Russell, David" <DRussell@thrupoint.net>
To: "'Stephen J. Wilcox '" <steve@telecomplete.co.uk>,
'Curtis Maurand ' <curtis@maurand.com>
Cc: 'Leo Bicknell ' <bicknell@ufp.org>,
"'nanog@merit.edu '" <nanog@merit.edu>
Date: Mon, 12 May 2003 16:38:58 -0400
Errors-To: owner-nanog-outgoing@merit.edu
This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.
------_=_NextPart_001_01C318C6.83589E00
Content-Type: text/plain;
charset="iso-8859-1"
You should keep in mind that Cisco routers have a limit on the number of
ICMP messages they will originate per second. (My mind fails me as to
whether it is 3 or 30). So you might lose a few ICMPs because of this.
David
-----Original Message-----
From: Stephen J. Wilcox
To: Curtis Maurand
Cc: Leo Bicknell; nanog@merit.edu
Sent: 5/12/03 10:49 AM
Subject: Re: PMTU and Broken Servers
You mean theres routers which get a large packet and silently drop it
rather
than return an icmp?
Curious as to know which vendors? (read fundementally broken!)
Steve
On Mon, 12 May 2003, Curtis Maurand wrote:
>
>
> I've had the problem before. Not all routers handle PMTU correctly.
>
> Curtis
>
> On Thu, 8 May 2003, Leo Bicknell wrote:
>
> >
> > I've recently had the pleasure of troubleshooting a problem I don't
> > normally have to deal with, and the results don't quite make sense
> > to me. I'm hoping someone can enlighten me as to what is going on.
> > A diagram:
> >
> > server---internet---fw---tunnelbox1----tunnelbox2----user
> >
> > The tunnel between the tunnelboxes is a lower (1480) MTU.
Originally
> > the user couldn't access some servers, turns out the firewall was
> > filtering ICMP Can't Fragment messages, preventing PMTU from working
> > in the server->user direction (tunnelbox1 would generate Can't
> > Fragement, firewall would filter).
> >
> > That's been corrected. Going to a server I control I see good PMTU
> > in both directions between the server and the user. However, there
> > are still a number of web servers for popular sites that behave
> > just like the firewall was still filtering Can't Fragments. The
> > theory is that the servers are behind a firewall/load balancer that
> > is filtering them on the server side -- but I find it slightly
> > (emphasis on the slightly) that someone would turn on PMTU
discovery,
> > and then filter it out right in front of the boxes where they turned
> > it on. Also, it seems to me most DSL users are behind PPPoE links
> > with lower MTU, and should get hit by the same problem.
> >
> > The temporary hack is to have tunnelbox1 clear the DF bit on all
> > incoming packets, which just causes the packets to get fragmented
> > going down the tunnel. A minor performance hit, but it works.
> >
> > This is a new problem to me, but I'm sure people have run into it
> > before. Are the servers really that broken (PMTU enabled, ICMP
> > Can't Fragement filtered)? Does the head end box of DSL services
> > generally do something to work around this (ie, clear the DF bit)?
> > Am I just being an idiot and missing something obvious?
> >
> >
>
>
Note: The information contained in this message may be privileged and
confidential and protected from disclosure. If the reader of this message
is not the intended recipient, or an employee or agent responsible for
delivering this message to the intended recipient, you are hereby notified
that any dissemination, distribution or copying of this communication is
strictly prohibited. If you have received this communication in error,
please notify us immediately by replying to the message and deleting it from
your computer. Thank you. ThruPoint, Inc.
------_=_NextPart_001_01C318C6.83589E00
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Diso-8859-1">
<META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version =
5.5.2653.12">
<TITLE>RE: PMTU and Broken Servers</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=3D2> You should keep in mind that Cisco routers have =
a limit on the number of ICMP messages they will originate per =
second. (My mind fails me as to whether it is 3 or 30). So =
you might lose a few ICMPs because of this.</FONT></P>
<P><FONT SIZE=3D2>David</FONT>
</P>
<P><FONT SIZE=3D2>-----Original Message-----</FONT>
<BR><FONT SIZE=3D2>From: Stephen J. Wilcox</FONT>
<BR><FONT SIZE=3D2>To: Curtis Maurand</FONT>
<BR><FONT SIZE=3D2>Cc: Leo Bicknell; nanog@merit.edu</FONT>
<BR><FONT SIZE=3D2>Sent: 5/12/03 10:49 AM</FONT>
<BR><FONT SIZE=3D2>Subject: Re: PMTU and Broken Servers</FONT>
</P>
<BR>
<BR>
<P><FONT SIZE=3D2>You mean theres routers which get a large packet and =
silently drop it</FONT>
<BR><FONT SIZE=3D2>rather </FONT>
<BR><FONT SIZE=3D2>than return an icmp?</FONT>
</P>
<P><FONT SIZE=3D2>Curious as to know which vendors? (read fundementally =
broken!)</FONT>
</P>
<P><FONT SIZE=3D2>Steve</FONT>
</P>
<P><FONT SIZE=3D2>On Mon, 12 May 2003, Curtis Maurand wrote:</FONT>
</P>
<P><FONT SIZE=3D2>> </FONT>
<BR><FONT SIZE=3D2>> </FONT>
<BR><FONT SIZE=3D2>> I've had the problem before. Not all =
routers handle PMTU correctly.</FONT>
<BR><FONT SIZE=3D2>> </FONT>
<BR><FONT SIZE=3D2>> Curtis</FONT>
<BR><FONT SIZE=3D2>> </FONT>
<BR><FONT SIZE=3D2>> On Thu, 8 May 2003, Leo Bicknell wrote:</FONT>
<BR><FONT SIZE=3D2>> </FONT>
<BR><FONT SIZE=3D2>> > </FONT>
<BR><FONT SIZE=3D2>> > I've recently had the pleasure of =
troubleshooting a problem I don't</FONT>
<BR><FONT SIZE=3D2>> > normally have to deal with, and the =
results don't quite make sense</FONT>
<BR><FONT SIZE=3D2>> > to me. I'm hoping someone can =
enlighten me as to what is going on.</FONT>
<BR><FONT SIZE=3D2>> > A diagram:</FONT>
<BR><FONT SIZE=3D2>> > </FONT>
<BR><FONT SIZE=3D2>> > =
server---internet---fw---tunnelbox1----tunnelbox2----user</FONT>
<BR><FONT SIZE=3D2>> > </FONT>
<BR><FONT SIZE=3D2>> > The tunnel between the tunnelboxes is a =
lower (1480) MTU.</FONT>
<BR><FONT SIZE=3D2>Originally</FONT>
<BR><FONT SIZE=3D2>> > the user couldn't access some servers, =
turns out the firewall was</FONT>
<BR><FONT SIZE=3D2>> > filtering ICMP Can't Fragment messages, =
preventing PMTU from working</FONT>
<BR><FONT SIZE=3D2>> > in the server->user direction =
(tunnelbox1 would generate Can't</FONT>
<BR><FONT SIZE=3D2>> > Fragement, firewall would filter).</FONT>
<BR><FONT SIZE=3D2>> > </FONT>
<BR><FONT SIZE=3D2>> > That's been corrected. Going to a =
server I control I see good PMTU</FONT>
<BR><FONT SIZE=3D2>> > in both directions between the server and =
the user. However, there</FONT>
<BR><FONT SIZE=3D2>> > are still a number of web servers for =
popular sites that behave</FONT>
<BR><FONT SIZE=3D2>> > just like the firewall was still filtering =
Can't Fragments. The</FONT>
<BR><FONT SIZE=3D2>> > theory is that the servers are behind a =
firewall/load balancer that</FONT>
<BR><FONT SIZE=3D2>> > is filtering them on the server side -- =
but I find it slightly</FONT>
<BR><FONT SIZE=3D2>> > (emphasis on the slightly) that someone =
would turn on PMTU</FONT>
<BR><FONT SIZE=3D2>discovery,</FONT>
<BR><FONT SIZE=3D2>> > and then filter it out right in front of =
the boxes where they turned</FONT>
<BR><FONT SIZE=3D2>> > it on. Also, it seems to me most DSL =
users are behind PPPoE links</FONT>
<BR><FONT SIZE=3D2>> > with lower MTU, and should get hit by the =
same problem.</FONT>
<BR><FONT SIZE=3D2>> > </FONT>
<BR><FONT SIZE=3D2>> > The temporary hack is to have tunnelbox1 =
clear the DF bit on all</FONT>
<BR><FONT SIZE=3D2>> > incoming packets, which just causes the =
packets to get fragmented</FONT>
<BR><FONT SIZE=3D2>> > going down the tunnel. A minor =
performance hit, but it works.</FONT>
<BR><FONT SIZE=3D2>> > </FONT>
<BR><FONT SIZE=3D2>> > This is a new problem to me, but I'm sure =
people have run into it</FONT>
<BR><FONT SIZE=3D2>> > before. Are the servers really that =
broken (PMTU enabled, ICMP</FONT>
<BR><FONT SIZE=3D2>> > Can't Fragement filtered)? Does the =
head end box of DSL services</FONT>
<BR><FONT SIZE=3D2>> > generally do something to work around this =
(ie, clear the DF bit)?</FONT>
<BR><FONT SIZE=3D2>> > Am I just being an idiot and missing =
something obvious?</FONT>
<BR><FONT SIZE=3D2>> > </FONT>
<BR><FONT SIZE=3D2>> > </FONT>
<BR><FONT SIZE=3D2>> </FONT>
<BR><FONT SIZE=3D2>> </FONT>
<BR><FONT SIZE=3D2>Note: The information contained in this =
message may be privileged and confidential and protected from =
disclosure. If the reader of this message is not the intended =
recipient, or an employee or agent responsible for delivering this =
message to the intended recipient, you are hereby notified that any =
dissemination, distribution or copying of this communication is =
strictly prohibited. If you have received this communication in =
error, please notify us immediately by replying to the message and =
deleting it from your computer. Thank you. ThruPoint, =
Inc.</FONT></P>
</BODY>
</HTML>
------_=_NextPart_001_01C318C6.83589E00--
