Problem of blocking ICMP packet while calculating Path MTU

Dear All,

I am in process of implementing Path MTU detection technique. So for
that I have to send ICMP ECHO request packets to destination host, and
process the received ICMP ECHO reply packets.

I read that the ICMP server is embedded in the kernel of OS itself, so
there is no need to write server code at all. So for sending and
receiving of ICMP packets we will use raw sockets without specifying
any port number.

But in between the network, some routers have some firewall
configuration so that they will simply drop any incomming ICMP packet
without sending any response to the sender. Hence originating host
will not be aware of the status of destination host.
These firewall settings are due to some attacks like Ping of deth,
Denial of request etc.

Can any one provide me any solution to overcome this problem.

Thanks in advance.

Rajat <(E-Mail Removed)> wrote:

> I am in process of implementing Path MTU detection technique. So for
> that I have to send ICMP ECHO request packets to destination host, and

Huh?? You do mean Path MTU Discovery, don't you?

> process the received ICMP ECHO reply packets.

> Can any one provide me any solution to overcome this problem.

Read RFC 1191.

-- Clifford Kite Email: "echo xvgr_yvahk-(E-Mail Removed)|rot13"
PPP-Q&A links, downloads: http://ckite.no-ip.net/
/* ... packets usually cross many administrative boundaries on their way
from a source to a destination and often the only point of agreement
between those separate administrations is that all problems are someone
else's fault. --Van Jacobson, abstract of April 97 MSRI talk */

On 8 May 2004 05:20:28 -0700, Rajat <(E-Mail Removed)> wrote:
> Dear All,
>
> I am in process of implementing Path MTU detection technique. So for
> that I have to send ICMP ECHO request packets to destination host, and
> process the received ICMP ECHO reply packets.
>
> I read that the ICMP server is embedded in the kernel of OS itself, so
> there is no need to write server code at all. So for sending and
> receiving of ICMP packets we will use raw sockets without specifying
> any port number.
>
> But in between the network, some routers have some firewall
> configuration so that they will simply drop any incomming ICMP packet
> without sending any response to the sender. Hence originating host
> will not be aware of the status of destination host.
> These firewall settings are due to some attacks like Ping of deth,
> Denial of request etc.
>
> Can any one provide me any solution to overcome this problem.

Are you actually establishing a connection, or just probing hosts you do
not control (probably NOT a good idea)?

I am no expert no tcp details. But if you establish an accepted valid
connection, I would think both ends would be aware of the other's MSS (40
bytes less than MTU). However, even that can be problematic if not
directly connected (destination behind NAT router).

When I sent test mail to smtp server behind adsl hardware router (with WAN
ping disabled) at home, it worked when mail was smaller than packet size.
But mail with attachment from work (DS-3 connection) to home (PPPoE) kept
doing "timeout during data transfer" (both ends mtu 1500, but fragmented
packets through mtu 1492 PPPoE were not accepted by Linux). As soon as I
set smtp server LAN nic to mtu 1492, it appropriately adjusted MSS so
client knew proper mtu to get through PPPoE, and the mail arrived.

So if a server is properly configured, it can work with a smaller than
default MTU even if PMTU discovery is blocked.

--
David Efflandt - All spam ignored http://www.de-srv.com/