[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: The IPv4 Internet MTU
On Oct 12, 2007, at 12:01, Doug Barton wrote:
On Fri, 12 Oct 2007, james woodyatt wrote:
I have a radical proposal: how about we tell the stateful packet
filter users that it's their own damned fault if their filters
break their favorite applications, and that they can either fix
their broken filters or they can turn them off?
While I'm as sympathetic as the next guy to a good net.purist rant,
if we want to find real solutions (where real is defined as useful
for actual users) we need to look at the real problems.
99.9% of home users who go to Fry's and buy a Netgear/Linksys/D-Link
or whatever "home router" don't have any idea what stateful packet
filtering, PMTUD, or a lot of other things mean, and they shouldn't
have to. It's unfortunate that PMTUD is broken on most of the IPv4
internet, but if we're going to do better with IPv6 we have to play
the hand we've been dealt.
I admire your appreciation for the virtues of pragmatism, but
respectfully, sir, I think my point was that we, the IETF, haven't
been dealt into this hand.
PMTUD is broken on most of the IPv4 internet for the same reason it's
currently broken on most of the IPv6 internet: stateful packet
filters that don't properly admit ICMP errors corresponding to their
underlying IP flows. The best we can do as engineers in the business
of setting standards is to document what behaviors in stateful packet
filters are known to break which application protocols, and recommend
that equipment vendors and network operators choose to deploy
networks that comply as much as possible with the proposed
standards. If people don't want to do that, and they insist on
deploying network equipment that is engineered deliberately for
failure, then I don't see how writing another RFC will help undo
their basic malfunction.
It is not a good idea for IETF to reinvent yet another way to pass
around traffic control messages that will be filtered improperly by
badly coded stateful packet filters with the result that applications
will be mysteriously broken in new and exciting ways for naïve users
without the technical ability to repair them. We already have a
method for passing such messages around today. It's called ICMP. It
works perfectly well when filters are absent or they are present and
coded properly. It could be made to work just as well in IPv4/NAT
and filtered IPv6 as it does today in unfiltered IPv6. If we invent
another mechanism, then we will just be inviting the filter coders
(hello? that's me!) to screw up our new mechanism just as badly as
they screwed up our old one. Don't think they won't try. They're
pretty resourceful when it comes to breaking the Internet. Some of
them (hi!) make a living doing it.
--
james woodyatt <jhw@apple.com>
member of technical staff, communications engineering