Forum Discussion
An Irule that Stops TLS (tcp) Fragmentation on Client Side
There is a requirement to implement a service that extracts Inserted traffic in extension header from subscribers. the insertion is done by PGW on packet core, and works on server side, which can successfully extract the information from the extension header. When the PGW Succesfully inserts the added extension, the solution on serverside works well.
The challenge is that the PGW frequently truncates the TLS Header (TCP), and the serverside (F5), is unable to see the added extension header, since it has been cut off. A technical explanation is goes thus.
"The EPG is configured for Heuristic TLS Enrichment, its Deep Packet Inspection (DPI) engine scans incoming TCP payloads on port 443. The EPG searches for the TLS ClientHello record header. It calculates the extension array offsets, dynamically shifts the remaining TLS bytes downstream, and injects Extension 17516 contains 4 bytes of TLS headers and 16 bytes of data). EPG platforms enforce strict MTU boundaries. If a subscriber's initial ClientHello packet is already 1,445 bytes, adding the 20-byte extension pushes it to 1,465 bytes. The EPG's internal network stack will instantly transmit the first 1,460 bytes and create a second TCP fragment for the remaining 5 bytes."
Is there an irule extension that can detect and stop this fragmentation of TCP/TLS Data on the Client side, to ensure the TLS CLIENTSSL_HELLO is never fragmented.
3 Replies
if havent, enable jumbo frame and adjust tcp windows size config on the pgw and f5.
it might make the tls headers not to be truncated into next tcp segment.- Melissa_C
Moderator
Hello Kazeem_Yusuf
I noticed zamroni777 has provided you with an article and wanted to encourage an update if that has assist you or if you need additional help.
- Seattle2k
Employee
If the receiving interface's MTU is 1500 bytes, then the max payload size is 1500 - 40 = 1460. Anything larger must be broken up / fragmented. BIG-IP can set the DF bit, but a 1480-byte payload (1510-byte frame) is not going to fit through an interface set to 1500-bytes MTU.
As zamruni777 indicated, the solution is to increase MTU. Jumbo Frames allows ~9000 byte MTU. But remember, if these packets are being transmitted across the pubiic internet, they will eventually get fragmented out there.
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com