Re: The IPv4 Internet MTU

[james woodyatt <jhw@apple.com>]

On Oct 12, 2007, at 07:23, Iljitsch van Beijnum wrote:
> It has to be in-band because the out-of-band method (ICMP) is  
> filtered in a small but significant number of all cases.  
> Unfortunately, UDP doesn't support options and inserting IPv6  
> option headers or IPv4 options will almost certainly trigger the  
> same filtering that makes using ICMP problematic. So the only  
> choice would be adding something to the next higher protocol on top  
> of UDP.

I'd hate to be repetitive and boring, but I'm shocked-- SHOCKED! I  
say-- to learn that stateful packet filtering is the root cause of so  
many problems for application transport.

I have a radical proposal: how about we tell the stateful packet  
filter users that it's their own damned fault if their filters break  
their favorite applications, and that they can either fix their  
broken filters or they can turn them off?  Since *when* has it been  
our job to reengineer the whole world because some idiot can't read  
the RFC series?

PMTUD for IPv4/UDP could work just fine through NAT if the state  
matching and translation code isn't totally broken.  The problem we  
are discussing here is in the wetware of the coders who write the NAT  
and stateful packet filter implementations.  It's their problem if  
applications don't work because their filters don't pass ICMP through  
for corresponding UDP state-- *not* ours.

Let's concentrate on the problems that belong to us.  That's what I say.


--
james woodyatt <jhw@apple.com>
member of technical staff, communications engineering