Digital Island sponsors DoS attempt?

Fri Oct 26 18:47:14 UTC 2001

I actually thought about that being a problem, only if you block ALL ICMP
messages. Any router beyond the blocking one will break PMTU discovery, so
yeah you're right. One could always deny specific ICMP types....

Marc 

-----Original Message-----
From: Bob K [mailto:melange at yip.org]
Sent: Friday, October 26, 2001 1:45 PM
To: Quibell, Marc
Cc: nanog at merit.edu
Subject: RE: Digital Island sponsors DoS attempt? 

On Fri, 26 Oct 2001, Quibell, Marc wrote:

> Finally, I do not believe PMTU uses pings to discover the PMTU. I believe
it
> uses TCP or UDP packets at the layers above IP, and it DOES use "ICMP
Packet
> Too big" responses (from the receiver) to cut it's packet size. So in
> reality, a router blocking ICMP from being routed through can still send
> these ICMP messages PMTU needs. Is this how you understand it?

Don't forget that routers or hosts beyond (from the point of view of the
host attempting PMTU) your ICMP-blocking router may have smaller MTUs than
the norm and may be trying to send ICMP errors back...

-- 
Bob <melange at yip.org> | We're all wrong.