Sequence of IP fragment packets on the wire
Hi,
as far as I can see, Linux sends out fragmented IP packets "butt-first":
11:34:53.927146 alice > bob: (frag 44605:343@1480) 11:34:53.927189 alice.4831 > bob.udpdemo: udp 1815 (frag 44605:1480@0+)
(where the first packet is actually the fragmented 2nd part of the second packet).
This confuses at least one firewall appliance. As I understand it, this is done for efficency reasons. Still, is there any way to suppress this and get the packets sent out in "head first" sequence? I know that routers might resort the fragments again but in my case I have an "alice -- firewall -- bob" topology which at the moment drops the fragment on the floor...
Is there a way to configure this? Maybe even connection specific?
I tested 2.2.19 and 2.4.18 with 100 MBit Ethernet (3Com and eepro100). Both show the same behaviour.
Regards
Henning
Signature · 5 lines
Dipl.-Inf. (Univ.) Henning P. Schmiedehausen -- Geschaeftsfuehrer INTERMETA - Gesellschaft fuer Mehrwertdienste mbH [email protected] Am Schwabachgrund 22 Fon.: 09131 / 50654-0 [email protected] D-91054 Buckenhof Fax.: 09131 / 50654-20
From: "Henning P. Schmiedehausen" <[email protected]>
Date: Thu, 3 Oct 2002 10:51:08 +0000 (UTC)
as far as I can see, Linux sends out fragmented IP packets "butt-first":
Right.
Is there a way to configure this? Maybe even connection specific?
No.
Quoted 6 lines · Henning P. Schmiedehausen
as far as I can see, Linux sends out fragmented IP packets "butt-first":
(where the first packet is actually the fragmented 2nd part of the second packet).This confuses at least one firewall appliance.
I'm afraid that this firewall appliance is fundamentally broken. Nothing you
can do to Linux can fix this fundamental breakage. I can give further examples, analogies, and argumentation, but it really should be obvious that IP, fundamentally, does not guarantee any particular reception order and anything that assumes it does cannot be fixed except by changing the assumption.
This is as bad as a TCP application that assumes one 'read' call will return
an entire line or command. You cannot push the problem elsewhere.
DS
Quoted 1 line · Henning P. Schmiedehausen
This confuses at least one firewall appliance. As I understand it,
You should replace that appliance. Packets can get re-ordered by a million different things on the wire not just by the fact Linux is optimising the fragment processes.
Quoted 1 line
Is there a way to configure this? Maybe even connection specific?
No
Alan
Quoted 6 lines
as far as I can see, Linux sends out fragmented IP packets "butt-first":
(where the first packet is actually the fragmented 2nd part of the second packet).
This confuses at least one firewall appliance.
The sequence-number of an IP Packet, whether or not it's fragmented, has nothing to do with any order of reception. The "2nd" part of a fragmented packet may be received at any time, in fact multiple times. Any so-called Network appliance that assumes that there is any specific order of packets being received is fundamentally broken.
Well designed network software can sometimes optimize its buffer handling if it "knows" that the last packet of a fragment has been received, but it can't count on any specific order because there isn't any. Even if you put all your "ducks in a row" on the wire, once the least-cost route becomes different for different packets, all bets are off. You might get one packet with satellite- link latency (seconds) and another with terrestrial latency (miliseconds).
Cheers,
Dick Johnson
Penguin : Linux version 2.4.18 on an i686 machine (797.90 BogoMips). The US military has given us many words, FUBAR, SNAFU, now ENRON. Yes, top management were graduates of West Point and Annapolis.
Hi,
thanks to anyone for making this clear. Replacing this particular system is currently out of question but I will take it on with the people from SonicWall (oops, now the name did slip, silly me...) to get this fixed ASAP.
Regards
Henning
Quoted 12 lines · Alan Cox
Quoted 1 line · Henning P. Schmiedehausen
This confuses at least one firewall appliance. As I understand it,
You should replace that appliance. Packets can get re-ordered by a million different things on the wire not just by the fact Linux is optimising the fragment processes.
Quoted 1 line
Is there a way to configure this? Maybe even connection specific?
No
Alan
Signature · 5 lines
Dipl.-Inf. (Univ.) Henning P. Schmiedehausen -- Geschaeftsfuehrer INTERMETA - Gesellschaft fuer Mehrwertdienste mbH [email protected] Am Schwabachgrund 22 Fon.: 09131 / 50654-0 [email protected] D-91054 Buckenhof Fax.: 09131 / 50654-20