<story><title>Broken packets: IP fragmentation is flawed</title><url>https://blog.cloudflare.com/ip-fragmentation-is-broken/</url></story><parent_chain></parent_chain><comment><author>magila</author><text>While the designers of TCP&amp;#x2F;IP got an amazing amount of things right, one things they missed rather badly was the need to take the incentives and motivations of the people participating in the network into account. I don&amp;#x27;t blame them for that. At the time the internet was an academic pursuit, so the idea of designing a protocol to resist breakage by self-interested commercial ISPs simply wasn&amp;#x27;t something that was on people&amp;#x27;s minds.&lt;p&gt;Taking IP fragmentation as a particular example: The protocols should be designed such that inability to perform PMTU discovery prevents any connections being established at all.&lt;p&gt;Designing protocols which will be robust in the face of human actors who may-or-may-not be entirely interested in doing things the intended way is incredibly difficult. To make things worse, once you make a mistake it is practically impossible to fix. Using fragmentation as an example again: Now that middle boxes which break PMTU discovery are established, it would be impractical to introduce a &amp;quot;fail unconditionally&amp;quot; protocol. People would simply blame the products which introduced such a protocol for being broken. You have to get it right from the start so that bad actors get caught out before their broken products can be deployed.</text></comment>
<story><title>Broken packets: IP fragmentation is flawed</title><url>https://blog.cloudflare.com/ip-fragmentation-is-broken/</url></story><parent_chain></parent_chain><comment><author>majke</author><text>Check out the online ICMP &amp;#x2F; Fragmentation checker:&lt;p&gt;IPv4 version: &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;icmpcheck.popcount.org&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;icmpcheck.popcount.org&lt;/a&gt;&lt;p&gt;IPv6 version: &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;icmpcheckv6.popcount.org&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;icmpcheckv6.popcount.org&lt;/a&gt;&lt;p&gt;If you see red - this means your ISP &amp;#x2F; cable modem is not really internet happy.&lt;p&gt;Funny thing, the ISP I use fails on the ICMP PMTU message delivery test on the first refresh, but succeeds on the second. What happens? The ICMP is delivered to middle box, which then FRAGMENTS MY TCP PACKETS. In other word - the ICMP is stopped at a middle box, who will ignore my packets DF flag and still, fragment them without my system even knowing. On second refresh the middle box remembers the Path MTU will be saved so the middle box will reduce the MSS on SYN packet. This is remembered for about 15 minutes. Middle boxes suck.</text></comment>