Hacker News Reader

Comment by iso1210 | Hacker News Reader

The world did, then people came along and started blocking ICMP

Yes. There is a special circle in hell for braindead firewall admins filtering ICMP. Unfortunately happens often enough that "MTU problem" is the first thing that comes to mind at the grandparents description. Next in line would be "broken DNS"...

They are not braindead. ICMP used to be a bit broken and folks got sick of ping floods, sweeps, redirect attacks and tunneling hacks etc. Some pretty major places block ICMP as a result to keep their network reasoning and security analysis simpler.

Just because they are major places doesn't mean they are right or such practice buys any improvement in security worth the operational cost it imposes.

ICMP ping of death was a thing in the 1990s. Those bugs have been fixed for more than 2 decades now.

What do ping floods do that TCP syn floods don't? (I expect you run at least one service on the exposed hosts)

Also what system even accepts ICMP based route redirects by default from the open internet?

And when I am in my less charitable moods, I would claim that said people are unqualified to not just to configure networks, but to have opinions worth considering when it comes to setting network policy.

Unfortunately the only qualification required is for you to want to communicate with their network.

In my utopic world, we wouldn't need "ICMP won't fragment". IPv4/IPv6 would have the MTU of exactly 4096 bytes.

Why not a higher or lower level protocol? Because this is the lowest level protocol which is end-to-end and has a path MTU. Lower level protocols would need to somehow handle the MTU and higher level protocols would need to fit their segments within the MTU.

Why 4096? Because this is a common page size on computers. Multiple of this would likely bring little benefits, due to GRO/GSO.

Also, it's my utopic world, so if you don't like it create your own. :))

Not much of a utopia if all you do is say the same problem is now unsolved at a different layer ;). Nothing special about the layer below IP that allows it to fix the problem in a way IP couldn't be made to - it's just an annoying problem to fix efficiently.

4096 can be too much for unstable connections, for example Wi-Fi or mobile.

Also, 4096 bytes at what level? Layer 2? And when you are using a tunnel, you add bytes and thus have to go higher than 4096 or go lower and reduce MTU, or fragment the packet to keep 4096 bytes.

You are just raising the limit, not solving the problem.

This is the network version of ‘640k should be enough for anyone’.

Don’t fixate this kind of policy in such a fundamental protocol.

The issue is how the network are glued together, your X MTU will be embedded in a VPN tunnel, PPPOE - and that device needs to tell your device about its MTU

How would this work for IP over IP networks?

Reply on news.ycombinator.com