|
North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: [NANOG] [OPSEC] Microsoft.com PMTUD black hole?
A few comments on your comments below.
RM=for(1)
{manage_risk(identify_risk(product[i++]) &&
(identify_threat[product[i++]))}
[email protected] giac
> -----Original Message-----
> From: [email protected] [mailto:[email protected]]
> On Behalf Of Iljitsch van Beijnum
> Sent: Thursday, May 08, 2008 3:24 AM
> To: Joel Jaeggli
> Cc: [email protected]; [email protected]; NANOG list
> Subject: Re: [OPSEC] [NANOG] Microsoft.com PMTUD black hole?
>
> On 8 mei 2008, at 9:53, Joel Jaeggli wrote:
>
> > Oddly enough there is a draft on the subject of icmp filtering
> > recomendations is making the rounds.
>
> >
> http://tools.ietf.org/wg/opsec/draft-gont-opsec-icmp-filtering-00.txt
>
> > The opsec working group ([email protected]) and the authors would
> > appreciate feedback from operators on the subject.
>
> Speaking as someone who isn't interested in reading an
> explanation of
> what happens when the message is filtered for every ICMP
> message known
> to man, I find this a completely useless document: I can't find the
> recommendations. Either they're there but impossible to find by
> looking at the table of contents or searching for "recommend", or
> they're not there in which case the title is EXTREMELY misleading.
I believe a table of what to filter where was recommended.
I hope that table includes filtering and ratelimiting from, through, and
to.
However blindly accepting recommendations without understanding the
possibly ramifications
such filtering can have on your network is not wise.
>
> Also:
>
> 2.1.1.5.4. Operational/interoperability impact if blocked Filtering
> this error message breaks the Path-MTU Discovery mechansim described
> in [RFC1191].
>
> This is completely insufficient because it doesn't mention
> that 99% of
> all TCP traffic on today's internet uses PMTUD and filtering these
> messages leads to broken connectivity towards destinations that have
> an MTU lower than the source (lower than 1500 in practice).
I suspect your statistics. I don't believe the number is anywhere near
99% but haven't seen a study that would support any actual % numbers of
traffic that relies on PMTUD. If your aware of such a study/research I
would be interested in reviewing the results.
Again filtering THROUGH a device is probably not advisable filtering TO
your device might be advisable.
>
> Please spell check and five levels of numbering is considered
> bad style.
> _______________________________________________
> OPSEC mailing list
> [email protected]
> https://www.ietf.org/mailman/listinfo/opsec
>
This communication is the property of Qwest and may contain confidential or
privileged information. Unauthorized use of this communication is strictly
prohibited and may be unlawful. If you have received this communication
in error, please immediately notify the sender by reply e-mail and destroy
all copies of the communication and any attachments.
_______________________________________________
NANOG mailing list
[email protected]
http://mailman.nanog.org/mailman/listinfo/nanog
|