Subject: [dnsext] Re: What ELSE relies on UDP fragmentation?

From: Stefan Winter <[email-masked]>
Date: Wed, 19 Aug 2009 07:52:54 +0200

[ Moderators note: Post was moderated, either because it was posted by
   a non-subscriber, or because it was over 20K.  
   With the massive amount of spam, it is easy to miss and therefore 
   delete relevant posts by non-subscribers. 
   Please fix your subscription addresses. ]

Hello,

(not subscribed to this list, sorry for breaking threading)

> Can anyone identify a major application other than DNSSEC which uses
UDP and assumes that packets greater than the Ethernet MTU can be sent
and will be properly fragmented and reassembled on traffic traversing
the Internet?

one other protocol that relies on IP fragmentation for UDP packets
working is RADIUS. The maximum datagram size for RADIUS packets is 4k,
and it can not be split into multiple datagrams. Whether or not you call
RADIUS "major" or not is your own choice :-)

In day-to-day deployment, we (eduroam, a large wireless LAN roaming
consortium) have hit the ~ 1500 MTU barrier repeatedly when using
authentication payloads which transfer large amounts of data (EAP-TLS,
most notably, which sends X.509 certificates bidirectionally in RADIUS
datagrams).

I'm following this thread here with some interest - the hint that most
OSes set the DF bit on every outgoing datagram for example is important
news for us (as it ruins the party for many EAP-TLS wireless users
world-wide).

Greetings,

Stefan Winter

-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche
6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg

Tel: +352 424409 1
Fax: +352 422473

---

From: "Aki Tuomi" <[email-masked]>
Date: Thu, 20 Aug 2009 08:43:07 +0300

> -----Original Message-----
> From: [email-masked] [mailto:owner-
> [email-masked]] On Behalf Of Stefan Winter
> Sent: Wednesday, August 19, 2009 8:53 AM
> To: [email-masked]
> Cc: Nicholas Weaver
> Subject: [dnsext] Re: What ELSE relies on UDP fragmentation?
> 

We have suffered from problems with RADIUS datagram sizes with authentication. It does seem that some systems are really not happy with fragmented RADIUS packets. But what my wireshark shows me, is that the fragmentation is not done on MTU size, but instead RADIUS performs the splitting itself (at least on radiator).

Aki Tuomi