Forum Discussion

boneyard's avatar
boneyard
Icon for MVP rankMVP
Jul 17, 2012

F5 setting don't fragment bit

am running into a situation where it appears the F5 is setting the don't fragment bit of a packet that didn't have it set initially. what can be causing this? is there a way to turn this off?

 

config
design
  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Jul 17, 2012
    Well... The BigIP is a proxy... So the packet that didn't have it set initially isn't actually the original packet... However I'd have expected that option to be part of the TCP profile. And I notice it isn't... Possibly because in IPv6 it isn't an option...

     

     

    Do you have an explicit reason for allowing packets without DNF set? Fragmentation in the network isn't good. Most sensible firewalls will drop fragments by default (They're too good a vector for a DOS attack). I find path-mtu discovery to be a much better proposition (However it does require network and firewall admins who know what they're doing).

     

     

    H
  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Jul 18, 2012
    well the application behind the f5 uses it. might it be the path-mtu discovery that causes the bit to be set?
  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Jul 18, 2012
    Ah. yes. Path-MTU REQUIRES the DNF bit to be set... That's how it detects the requirement for the MTU to be adjusted (As you get back an ICMP error indicating the MTU that is necessary to cross a link when a packet can't be fragmented).

     

     

    Sorry, thought you had an issue with the DNF being set somewhere.

     

     

    H