Hamish, forgive me if it seems I'm being argumentative but this is a lot like the conversations I have with people about Virtual Addresses not needing to be in the same subnet as any Self IP the understanding that an apparent restriction or 'rule' doesn't exist can completely change a design or approach.
MOst modern hosts will actually accept inbound packets larger than the configured MTU, but there's no guarantee. ALL the MTU's on a local subnet MUST be the same size. So that's another downside to removing the DF flag.ĭropping your local MTU to make a remote host work is also bad. Most hosts/firewalls will/should be configured to DROP fragmented packets. Send enough fragmented packets to a host and it's a great DOS attack. The target host has to buffer all thise fragments for an amount of time so it can rebuild the whole packet. So why not just fragment? Because it's bad. WHich lowers throughput as the overheads go up. That means many more packets for the same amount of data. Without it, you have to make the assumption that the path MTU to a remote host is 512 Bytes. This means that if a packet is too lareg to pass across a link with a different MTU, the packet muct be dropped and a message (ICMP host unreachable) must be sent back to the source to tell them to lower their MTU (Path MTU) to the remote host. what adverse affect when this bit is set ?ĭF bit is to tell routers NOT to fragment packets. Before that, I need to know why F5 set DF bit in first place ?Īnd what the meaning of this bit ?.
0 kommentar(er)
