Re: IP Fragmentation - Not reliable over the Internet?

2013-10-02 Thread Emile Aben
On 31/08/2013 13:09, Randy Bush wrote: i wonder if this is correlated with the high number of probes being behind nats. Maybe this provides a bit of insight: From a test last week from all RIPE Atlas probes to a single known good MTU 1500 host I compared probes where I had both a ping test

Re: IP Fragmentation - Not reliable over the Internet?

2013-10-02 Thread Randy Bush
this needs publication on your adventure game of a web site, please. it will seriously 'inform' some discussion going back and forth on ietf lists. This is now published on RIPE Labs. For the adventurous: https://labs.ripe.net/Members/emileaben/ripe-atlas-packet-size-matters some hours

Re: IP Fragmentation - Not reliable over the Internet?

2013-09-20 Thread Kristian Kielhofner
I know I'm digging up an old thread here but I've spent some time analyzing some of the significant changes that Apple has made to the Facetime protocol, apparently with a huge focus on IP packet size to avoid fragmentation issues:

Re: IP Fragmentation - Not reliable over the Internet?

2013-09-02 Thread Emile Aben
On 31/08/2013 13:13, Randy Bush wrote: could you please test with ipv6? This is what I see for various IPv6 payloads (large ICMPv6 echo requests) from all RIPE Atlas probes that where available at the time to a single known good MTU 1500 destination: plenfail% nr_probes 100 9.64

Re: IP Fragmentation - Not reliable over the Internet?

2013-09-02 Thread Fred Baker (fred)
On Aug 27, 2013, at 12:34 AM, Owen DeLong o...@delong.com wrote: If I send a packet out as a legitimate series of fragments, what is the chance that they will get dropped somewhere in the middle of the path between the emitting host and the receiving host? To my thinking, the answer to

Re: IP Fragmentation - Not reliable over the Internet?

2013-09-02 Thread Owen DeLong
On Sep 1, 2013, at 23:11 , Fred Baker (fred) f...@cisco.com wrote: On Aug 27, 2013, at 12:34 AM, Owen DeLong o...@delong.com wrote: If I send a packet out as a legitimate series of fragments, what is the chance that they will get dropped somewhere in the middle of the path between the

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-31 Thread Emile Aben
On 30/08/2013 16:36, Benno Overeinder wrote: On 08/30/2013 01:58 PM, Randy Bush wrote: In a study using the RIPE Atlas probes, we have used a heuristic to figure out where the fragments where dropped. And from the Atlas probes where IP fragments did not arrive, there is a high likelihood the

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-31 Thread Randy Bush
could you please test with ipv6? thanks! randy

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-31 Thread Randy Bush
i wonder if this is correlated with the high number of probes being behind nats. Maybe this provides a bit of insight: From a test last week from all RIPE Atlas probes to a single known good MTU 1500 host I compared probes where I had both a ping test with ipv4.len 1020 and ipv4.len 1502.

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-30 Thread Masataka Ohta
Mark Andrews wrote: Ensure that the firealls at both ends pass ICMP/ICMPv6 PTB. Only idiots block all ICMP/ICMPv6. Yes there are a lot of idiots in the world. The worst idiots are people who designed ICMPv6 [RFC2463] as: (e.2) a packet destined to an IPv6 multicast address (there

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-30 Thread Randy Bush
In a study using the RIPE Atlas probes, we have used a heuristic to figure out where the fragments where dropped. And from the Atlas probes where IP fragments did not arrive, there is a high likelihood the problem is with the last hop to the Atlas probe. i wonder if this is correlated with

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-30 Thread Benno Overeinder
On 08/30/2013 01:58 PM, Randy Bush wrote: In a study using the RIPE Atlas probes, we have used a heuristic to figure out where the fragments where dropped. And from the Atlas probes where IP fragments did not arrive, there is a high likelihood the problem is with the last hop to the Atlas

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-29 Thread Benno Overeinder
On 8/27/13 4:04 PM, Leo Bicknell wrote: I'm pretty sure the failure rate is higher, and here's why. The #1 cause of fragments being dropped is firewalls. Too many admins configuring a firewall do not understand fragments or how to properly put them in the rules. Where do firewalls exist?

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-29 Thread Emile Aben
On 29/08/2013 04:22, Owen DeLong wrote: Has the path MTU been measured for all vantage point pairs? I didn't, but see http://www.nlnetlabs.nl/downloads/publications/pmtu-black-holes-msc-thesis.pdf Fig 23 (page 24) for path MTU data from roughly a year ago (thanks Benno for posting that link).

RE: IP Fragmentation - Not reliable over the Internet?

2013-08-29 Thread Christopher Palmer
, really quite helpful. -Original Message- From: wher...@gmail.com [mailto:wher...@gmail.com] On Behalf Of William Herrin Sent: Tuesday, August 27, 2013 10:45 AM To: Christopher Palmer Cc: North American Network Operators' Group Subject: Re: IP Fragmentation - Not reliable over the Internet

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-29 Thread Mark Andrews
Message- From: wher...@gmail.com [mailto:wher...@gmail.com] On Behalf Of William Herrin Sent: Tuesday, August 27, 2013 10:45 AM To: Christopher Palmer Cc: North American Network Operators' Group Subject: Re: IP Fragmentation - Not reliable over the Internet? On Mon, Aug 26, 2013 at 8:01 PM

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-29 Thread Owen DeLong
On Aug 29, 2013, at 18:15 , Mark Andrews ma...@isc.org wrote: In message a708ea6a03eb4ca7a14f5b16e4ce8...@bn1pr03mb171.namprd03.prod.outlook .com, Christopher Palmer writes: This is what I'm concerned about: 1. If I originate IP packet fragments, such as an 8000 byte NFS packet

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-28 Thread Tore Anderson
* Owen DeLong On Aug 27, 2013, at 07:33 , valdis.kletni...@vt.edu wrote: Saku Ytti and Emile Aben have numbers that say otherwise. And there must be a significantly bigger percentage of failures than pretty close to 0, or Path MTU Discovery wouldn't have a reputation of being next to

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-28 Thread Emile Aben
On 28/08/2013 08:05, Tore Anderson wrote: * Owen DeLong On Aug 27, 2013, at 07:33 , valdis.kletni...@vt.edu wrote: Saku Ytti and Emile Aben have numbers that say otherwise. And there must be a significantly bigger percentage of failures than pretty close to 0, or Path MTU Discovery

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-28 Thread Owen DeLong
Has the path MTU been measured for all vantage point pairs? Is it known to be 1500 or just the end-point MTUs? That could affect your results very differently. Owen On Aug 28, 2013, at 02:26 , Emile Aben emile.a...@ripe.net wrote: On 28/08/2013 08:05, Tore Anderson wrote: * Owen DeLong

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-27 Thread Saku Ytti
On (2013-08-27 00:01 +), Christopher Palmer wrote: If anyone has any data or anecdotes, please feel free to send an off-list email or whatever. [y...@ytti.fi ~]% ssh ring ring-all -t90 ping -s 1473 -c2 -w3 ip.fi|pastebinit http://p.ip.fi/KA7N [ytti@sci ~]% curl -s

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-27 Thread Owen DeLong
On Aug 26, 2013, at 22:02 , valdis.kletni...@vt.edu wrote: On Tue, 27 Aug 2013 00:01:45 -, Christopher Palmer said: What is the probability that a random path between two Internet hosts will traverse a middlebox that drops or otherwise barfs on fragmented IPv4 packets? THe fact

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-27 Thread Emile Aben
On 27/08/2013 08:55, Saku Ytti wrote: On (2013-08-27 00:01 +), Christopher Palmer wrote: If anyone has any data or anecdotes, please feel free to send an off-list email or whatever. [y...@ytti.fi ~]% ssh ring ring-all -t90 ping -s 1473 -c2 -w3 ip.fi|pastebinit http://p.ip.fi/KA7N

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-27 Thread Tony Finch
Christopher Palmer christopher.pal...@microsoft.com wrote: What is the probability that a random path between two Internet hosts will traverse a middlebox that drops or otherwise barfs on fragmented IPv4 packets? This question is important for large EDNS packets so you'll find some recent

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-27 Thread Jaap Akkerhuis
Christopher Palmer christopher.pal...@microsoft.com wrote: What is the probability that a random path between two Internet hosts will traverse a middlebox that drops or otherwise barfs on fragmented IPv4 packets? This question is important for large EDNS packets

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-27 Thread Saku Ytti
On (2013-08-27 10:45 +0200), Emile Aben wrote: 224 vantage points, 10 failed. 48 byte ping:42 out of 3406 vantage points fail (1.0%) 1473 byte ping: 180 out of 3540 vantage points fail (5.1%) Nice, it's starting to almost sound like data rather than anecdote, both tests implicate 45%

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-27 Thread Leo Bicknell
On Aug 27, 2013, at 6:24 AM, Saku Ytti s...@ytti.fi wrote: On (2013-08-27 10:45 +0200), Emile Aben wrote: 224 vantage points, 10 failed. 48 byte ping:42 out of 3406 vantage points fail (1.0%) 1473 byte ping: 180 out of 3540 vantage points fail (5.1%) Nice, it's starting to almost

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-27 Thread Valdis . Kletnieks
On Tue, 27 Aug 2013 00:34:57 -0700, Owen DeLong said: That's a lot of questions he didn't ask. This isn't your first rodeo. You should know by now that the question actually asked, the question *meant* to be asked, and the question that actually needed answering are often 3 different things.

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-27 Thread Blake Dunlap
And then you have other issues like networks that arbitrarily set DF on all packets passing through them. That burnt a good three days of my life back in the day. -Blake On Tue, Aug 27, 2013 at 9:33 AM, valdis.kletni...@vt.edu wrote: On Tue, 27 Aug 2013 00:34:57 -0700, Owen DeLong said:

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-27 Thread Dave Brockman
On 8/27/2013 10:04 AM, Leo Bicknell wrote: On Aug 27, 2013, at 6:24 AM, Saku Ytti s...@ytti.fi wrote: On (2013-08-27 10:45 +0200), Emile Aben wrote: 224 vantage points, 10 failed. 48 byte ping:42 out of 3406 vantage points fail (1.0%) 1473 byte ping: 180 out of 3540 vantage points

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-27 Thread William Herrin
On Mon, Aug 26, 2013 at 8:01 PM, Christopher Palmer christopher.pal...@microsoft.com wrote: What is the probability that a random path between two Internet hosts will traverse a middlebox that drops or otherwise barfs on fragmented IPv4 packets? Hi Christopher, I think there might be three

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-27 Thread Owen DeLong
On Aug 27, 2013, at 07:33 , valdis.kletni...@vt.edu wrote: On Tue, 27 Aug 2013 00:34:57 -0700, Owen DeLong said: That's a lot of questions he didn't ask. This isn't your first rodeo. You should know by now that the question actually asked, the question *meant* to be asked, and the

IP Fragmentation - Not reliable over the Internet?

2013-08-26 Thread Christopher Palmer
I am trolling for information/community wisdom. What is the probability that a random path between two Internet hosts will traverse a middlebox that drops or otherwise barfs on fragmented IPv4 packets? If anyone has any data or anecdotes, please feel free to send an off-list email or

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-26 Thread Valdis . Kletnieks
On Tue, 27 Aug 2013 00:01:45 -, Christopher Palmer said: What is the probability that a random path between two Internet hosts will traverse a middlebox that drops or otherwise barfs on fragmented IPv4 packets? THe fact you're posting indicates that you already know the practical answer: