tech-net archive
[
Date Prev][
Date Next][
Thread Prev][
Thread Next][
Date Index][
Thread Index][
Old Index]
Re: ssh's "bad packet length" vs. SACK and IPsec
> While those two patches makes the whole thing happy, I think we should
> re-visit the path MTU discovery code to be more efficient. In the case
> of blackholes for instance, we should make use of icmp_mtudisc's clever
> table. And I still think we should act on ICMP Need Fragment messages
> immediately.
there are some reasons not to act on icmp messages immediately.
http://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html
> I'd appreciate if someone with TCP and possibly SACK knowledge would
> confirm my analysis and the correctness of the patch I suggest.
> Otherwise I'll commit sometime later...
although i don't claim that i'm an expert of these area,
these analysis and patches seem correct to me.
YAMAMOTO Takashi
Home |
Main Index |
Thread Index |
Old Index