Re: [Dnsmasq-discuss] seeing www.ietf.org fail dnssec with dnsmasq rc7

2015-05-07 Thread Simon Kelley
On 06/05/15 23:12, Toke Høiland-Jørgensen wrote: Simon Kelley si...@thekelleys.org.uk writes: The MTU if the SIXXs IPv6 network interface is 1428. Failure to receive UDP packets larger than the MTU is a bigger bug than DNS, but I don't know if it's a SIXXS problem or a wider IPv6 one.

Re: [Dnsmasq-discuss] seeing www.ietf.org fail dnssec with dnsmasq rc7

2015-05-07 Thread Toke Høiland-Jørgensen
Simon Kelley si...@thekelleys.org.uk writes: It's difficult to see how that would work in practise for DNS. Take the Google-public-DNS example. It's clearly not sane for Google's servers to do PMTU on the address of every client, just to send one UDP packet, and caching PMTU for clients is

Re: [Dnsmasq-discuss] seeing www.ietf.org fail dnssec with dnsmasq rc7

2015-05-07 Thread Simon Kelley
Using ping6 2001:4860:4860:: -s packet size (that's the Google public DNS server) I see answers up to packet size 1344. It would be very interesting to know if others see the same (ie it's a property of the server) or different (it's a property of the link). Unfortunately, this only tells

Re: [Dnsmasq-discuss] seeing www.ietf.org fail dnssec with dnsmasq rc7

2015-05-07 Thread Simon Kelley
On 07/05/15 10:41, Toke Høiland-Jørgensen wrote: Simon Kelley si...@thekelleys.org.uk writes: It's difficult to see how that would work in practise for DNS. Take the Google-public-DNS example. It's clearly not sane for Google's servers to do PMTU on the address of every client, just to send

Re: [Dnsmasq-discuss] seeing www.ietf.org fail dnssec with dnsmasq rc7

2015-05-07 Thread Toke Høiland-Jørgensen
Simon Kelley si...@thekelleys.org.uk writes: Using ping6 2001:4860:4860:: -s packet size (that's the Google public DNS server) I see answers up to packet size 1344. I get answers up to -s 1432. This is on an he.net tunnel. -Toke ___

Re: [Dnsmasq-discuss] seeing www.ietf.org fail dnssec with dnsmasq rc7

2015-05-07 Thread Toke Høiland-Jørgensen
Simon Kelley si...@thekelleys.org.uk writes: But if they fragment, what size should they fragment to? I guess inthe absence of any information to the contrary, 1280 bytes. Yes, I would think so. Also, the RFC has this to say about the size of the packets pre-fragmentation: A node must be

Re: [Dnsmasq-discuss] seeing www.ietf.org fail dnssec with dnsmasq rc7

2015-05-07 Thread Kevin Darbyshire-Bryant
On 07/05/2015 13:54, Simon Kelley wrote: On 07/05/15 10:41, Toke Høiland-Jørgensen wrote: Simon Kelley si...@thekelleys.org.uk writes: It's difficult to see how that would work in practise for DNS. Take the Google-public-DNS example. It's clearly not sane for Google's servers to do PMTU on

Re: [Dnsmasq-discuss] seeing www.ietf.org fail dnssec with dnsmasq rc7

2015-05-07 Thread Dave Taht
on a comcast native ipv6 connection, 1232 from OSX (ping6 -s 1232 2001:4860:4860::) On the router *itself* I can't even ping6 -s 80 2001:4860:4860:: PING 2001:4860:4860:: (2001:4860:4860::): 80 data bytes ^C --- 2001:4860:4860:: ping statistics --- 1 packets transmitted,

Re: [Dnsmasq-discuss] seeing www.ietf.org fail dnssec with dnsmasq rc7

2015-05-07 Thread Nicholas Weaver
One important consideration: The Internet has decreed a long time ago that fragments don't work for IPv4, and REALLY don't work for IPv6: the amount of systems that drop fragments for V6 is off the chart. For DNS, this means you get silent failures when the reply is bigger than the network's