How to clear Don't Fragment (DF) bit

I know, I know, how about https://tools.ietf.org/html/rfc879 instead.

 

 

You're right, there is no standard, MTU is a maximum; by definition, it can be reduced. To quite a low figure depending on the Ethernet speed/type it seems (every day is a school day).

 

 

The rest, we'll have to agree to disagree.

 

 

Cheers

Whoops, can't actually read any posts on page 2 for some reason but I think I may have said minimum MTU which is rubbish, I meant minimum packet size. Also, this doesn't change based on type/speed.

I can't quit it seems.

 

 

Note, as of 802.3-2008, the maximum MTU is 2000 Bytes, 1500 max for payload, 500 for headers for tagging, Q in Q and whatever else come up.

I can't see page 2 either FWIW...

 

 

However you need to look at both the ethernet standards (Which define Max MTU and minimum packet size. Yes there is one, it's about 60Bytes IIRC which is calculated from the time it takes the pre-amble of an ethernet packet on coax to make it all the way from one end of a repeater network to the other. Anything less is a runt and should be dropped), and the IPv4 standards as well (Which define such things as all hosts on a given subnet MUST have the same MTU). The MTU (MAX size) DOES change with faster speeds. Up to 100Mbps it's defined as a hard limit of 1500 Bytes. Gb and above have about 9kB (Jumbo Frames).

 

 

OK. So in the early days IP stacks used to accept packets up to the size of the configured MTU. Which meant if you changed the MTU to something lower on ONE host, you'd get strange issues with hosts on the same VLAN being unable to talk to each other properly. On a modern OS that's (Hopefully) unlikely to happen. The incoming packet is USUALLY not just truncated.

 

 

BUT... That doesn't hold for routers. Drop the MTU on a router and you'll affect almost everything. For a start things will need to fragment... So if you drop the MTU on one interface of the BigIP where it's acting as a router, you'll have to drop it on all... So anything passing across this interface you've just altered using a FastL4 profile and network VS's (e.g. configured as a router) is now going to have to fragment... Add in a few more over zealous firewall admins, and you've just broken the traffic across your own BigIP.

 

 

But back to the original discussion regarding dropping the MTU for ONE host on a network... For reference checkout http://tools.ietf.org/html/rfc1042 Page 4. Bottom of the discussion about Maximum Transmission Unit. Note the word MUST. It's not a SHOULD which means it's a good idea. It's a MUST. That's a current RFC BTW, even if it is probably older than most of the audience (Circa 1988)

 

 

Maximum Transmission Unit

 

 

The Maximum Transmission Unit (MTU) differs on the different types of

 

IEEE 802 networks. In the following there are comments on the MTU

 

for each type of IEEE 802 network. However, on any particular

 

network all hosts must use the same MTU. In the following, the terms

 

"maximum packet size" and "maximum transmission unit" are equivalent.

 

 

H

test...

test2

test3

test4

OK, I'll defer to your greater wisdom here and thanks for lightly roasting me rather than flaming me (lesson: don't debate with an MVP when you haven't got time or evidence in hand).

 

 

As a standards friendly compromise, perhaps I could suggest lowering the MTU only where there is a small interconnect between the F5s and say, external firewalls using the VLAN in question and where the MTU on the firewalls is also reduced. Of course, this could be a bad idea and lead to fragmentation where the F5 isn't the end point or if the VLAN is used by any other routing device so it would only be recommended where that isn't the case, which wouldn't be many places.

 

 

So, in summary, a bad idea in theory at least. An iRule command to set the MSS would be an ideal alternative where clients connect over networks outside of your control.

When client ping 1500 Byte (some is 1482) to that problem virtual server (letter X.X.X.X) and X.X.X.X reply with DF bit

but first hop is switch cisco nexus 7000 and (probaly checkpoint firewall) and what it does is checkpoint drop packet and sent " ICMP Destination unreachable (Fragmentation needed) " to X.X.X.X

this picture is some of all topology

http://upic.me/i/dp/f5-firsthop.png

ps. In linux based ICMP request will set DF bit , but Did ICMP reply from F5 is DF bit set ? >>> this is problem make checkpoint drop ICMP reply packet (cause ICMP reply have more than 1500 bytes and DF bit is set (so it'll not fragmented)) ......but i didn't sure Is F5 resend smaller ICMP reply. I'll investigate more.