Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm seeing an ICMP storm from a mobile phone netblocks belonging to "TELEFONICA MOVILES". Periodically we will get upwards of 5 million in a few seconds, all something like this:

08:12:05.740781 IP (tos 0x0, ttl 112, id 40224, offset 0, flags [none], proto ICMP (1), length 56) 200.76.88.6 > A.B.C.D: ICMP 200.39.21.96 unreachable - need to frag (mtu 250), length 36

("A.B.C.D" is my ip)

Is an mtu of 250 even possible or legal? 68? These ICMPs are connected with larger problems on our end, but I can't tell if they're a symptom, cause or just coincidence.

What does the path MTU discovery algorithm do in this case? The server is FreeBSD 7.

share|improve this question
add comment

1 Answer

In case anyone cares, here's what I found.

Short answer is that no, these small MTUs are not legal but FreeBSD 7 & 8 should handle the situation better since some code changes were committed around the end of August.

This problem report has more: http://www.freebsd.org/cgi/query-pr.cgi?pr=146628

Path MTU discovery was not clearing the "don't fragment" flag, which means that a stubborn bad-behaving host on the other side would continue to send the storms of unreachable "frag needed" messages. Now after the first tiny MTU is received DF is cleared, which effectively moves the problem downstream to the router nearest the offender. (Since they will have to make absurd fragments for the offender.)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.