[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: threats ID

Iljitsch;

A few years ago, transport people finally recognized it and
had a BoF or WG to do PMTUD at the transport layer. I haven't
traced the activity, because I think PMTUD is a bad idea even
if it is implemented at the transport layer.


In IPv4 PMTUD is mostly a TCP thing:

Whether PMTUD is a TCP thing or not is independent of IP layer.

UDP and other non-TCP packets are generally transmitted with the DF bit set to zero.

It is because minimum MTU of IPv4 is too small.

However, this isn't possible in IPv6: if a router returns a "packet too big" ICMP message, the source is required to start fragmenting subsequent packets. So in IPv6, PMTUD is very much an IP layer issue, even if the transport layer is also aware of it.

Just send 1280 bytes.

Given that all the protocols are required to operate with MTU of
1280 anyway, that most link will have MTU of 1500 forever, that
no multicast protocols can perform PMTUD and that each transport
and application layer protocol must be modified to accomodate
PMTUD, there is no point to be bothered to have PMTUD.

It is very good design of IPv6 to outlaw fragmentation.

Even better is to make minimum MTU 1280.

The best could have been to make minimum MTU 1500 to
outlaw dialup protocol of PPP over Ethernet, though.

Fortunately none the MH mechanisms that have been proposed here use NAT (as far as I can remember, at least). 

I'm not sure what do you mean "proposed" but Dave Crocker explicitely
admit his proposal essentially NAT.

This is important, because true man in the middle capability isn't something that is easily achieved, while "man on the sideline", where the attacker can observe data and inject his own, but not stop the real data from flowing, is fairly trivial to achieve in many situations.


Maybe. But, it has nothing to do with M6.


I tend to agree but I don't think we can entirely dismiss the potential attacsk that go beyond what's possible today when attackers have this capability. 

I have shown, with DNS, that what's possible today is connection
hijacking, which means it is already worst.

Masataka Ohta