Re: ICMP fragmentation required but DF set problems.

[Niels Provos <provos () CITI UMICH EDU>]

> PMTU discovery is used by TCP (primarily if not exclusively). Isn't it
> possible to 1. check TCP sequence numbers in ICMP frag. needed messages
> generated as a response to a TCP datagram (in the same way they should be
> checked on any ICMP dest. unreachable to prevent a trivial DoS),
> 2. disregard any other ICMP frag. needed message?
That's how we do it in OpenBSD in the IPv4 case.

Since the ICMP has to include the IP packet + 8 bytes from the
following header, you can just look up any tcb that corresponds to the
quoted TCP header in the ICMP need fragment message.  If you dont have
such a tcb, you ignore the ICMP message.  This basically reduces the
attack to an adversary who can sniff your connection, but that would
allow her to do all kinds of other things to your TCP connection.

IPv6 is another case though.  Here you have mandatory PMTU for all
protocols.

Niels.