Re: Fragment ID generation and Flow Label generation (was: Re: Fragmentation-related security issues)

2012-01-30 Thread Philip Homburg
In your letter dated Fri, 27 Jan 2012 19:13:46 -0300 you wrote: >> For IPv4, either you have an mtu of 1500 or you use mss clamping. Relying on >> pmtud gives a bad user experience. > >Since IPv4 MTUs can be as low as 296, and since I doubt you clamp the >MSS to such a low value, you still rely on

Fragment ID generation and Flow Label generation (was: Re: Fragmentation-related security issues)

2012-01-27 Thread Fernando Gont
On 01/27/2012 06:08 PM, Philip Homburg wrote: >>> So any system that is too busy to keep destination cache entries for a long >>> time will effectively send fragments with a random number. >> >> There are always tradeoffs in the IP-ID generation algorithms. If you >> don't like any of the forementi