Subject: Re: (ngtrans) Something's missing

From: Erik Nordmark <[email-masked]>
Date: Wed, 2 May 2001 15:18:41 +0200 (CEST)

> Regarding fragmented ICMP packets, i think something is badly missing from
> RFC 2766/2765. I just discovered the hard way that it is impossible to
> translate fragmented ICMP packets. Since ICMPv4 doesn't take into account
> the pseudo header for checksum while ICMPv6 does. So in case of fragmented
> ICMP packets, we can never calculate the checksum since the "payload length"
> in IP header is not equal to the packet's actual length. 

Which is why the IETF operates using rough consensus and running code -
thanks for catching this.

> I think the only way to do this would be to buffer the fragmented ICMP
> packets and do the checksum from scratch. (as is suggested for "frag. UDP
> packets with 0 checksum" by the RFC).......Any comments???

Which such a thing doesn't add implications for NAT-PT it does mean
that you can't have multiple SIIT boxes at a boundary and letting
IP routing get you to the nearest, since when routing flaps some fragments
might appear at one SIIT box and other fragments at another.
In this case you'll just end up dropping the fragmented ICMP packet.

   Erik