ietf
[Top] [All Lists]

Re: Problem of blocking ICMP packets

2004-06-17 06:45:33


Mike S wrote:

At 12:34 AM 6/16/2004, Sally Floyd wrote...

Alberto Medina, Mark Allman, and I have a draft paper on
"Measuring the Evolution of Transport Protocols in the Internet"
that has a section (Section V.B.) on Path MTU Discovery.
From the paper:

"Table X shows that PMTUD is used and succeeded for slightly less
than half of the [web] servers on our list.  For 31\% of the servers
on our list, the server did not attempt Path MTU Discovery.  For
18\% of the servers on our list, Path MTU Discovery failed, presumably
because of middleboxes that block ICMP packets on the path to the
web server."

Any router configured to block ICMP packets is, quite simply,
in violation of RFC792 (STD5), which clearly states "ICMP is actually an integral part of IP, and must be implemented by every IP module." For a router, "implemented" means forwarded to the destinations next
hop.

RFC1812, Sec 5.2.7.1, where the 'frag needed' variant is mentioned (type 3, code 4), is more specific on this point. Routers must emit these errors - or, if administrative restrictions apply, code 13 "Communication Administratively Prohibited" errors.

So the fact is, by blocking ICMP, such ISPs have broken IP connectivity, and can no longer claim to be providing Internet (IP) service.

The same can be said for those providing NAT'd IP service, for similar reasons. ;-)

Joe

Attachment: signature.asc
Description: OpenPGP digital signature

_______________________________________________
Ietf mailing list
Ietf(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/ietf