ietf
[Top] [All Lists]

Re: interception proxies

2000-04-11 20:40:02
   Date: Tue, 11 Apr 2000 16:47:04 -0600 (MDT)
   From: Vernon Schryver <vjs(_at_)calcite(_dot_)rhyolite(_dot_)com>

   Which is why it was depressing.  Oh, well, perhaps a future version of
   the Problems draft will consider that issue and say as others wrote, it's
   not a problem and can be fixed with big buffers watching IP ID's, avoiding
   UDP, assuming good MSS's or discovery prevent TCP/IP fragmentation, or
   whatever.

And the latest kludge which has been called to my attention is ISP's
that tamper with the MSS values in TCP SYN packets in flight.  This is
done to work around smaller MTU's caused by PPP over Ethernet (and other
tunnelling mechanisms) interacting badly with Path MTU discovery
failures, which in turn are caused by firewalls that filter out the
wrong sorts of ICMP packets.

Hmmm, yet another thing which IPSEC will break.....

                                                        - Ted



<Prev in Thread] Current Thread [Next in Thread>