[dns-operations] PMTUD of .org servers
fw at deneb.enyo.de
Sat Jun 20 14:32:37 UTC 2009
* Paul Vixie:
>> From: Florian Weimer <fw at deneb.enyo.de>
>> Date: Sat, 20 Jun 2009 16:00:01 +0200
>> I know it's very difficult to build static packet filter rules which
>> handle fragmented traffic properly. (Stateful packet filters which are
>> part of proprietary network devices are usually not fast enough to cope
>> with heavy DNS or HTTP traffic.) I can't really fault anyone who tries
>> to make shortcuts.
> then they ought to pass all udp fragments to/from their dns servers,
Yes, except that it sometimes doubles or triples the rule count
(there's the issue of small fragment offsets to worry about).
More information about the dns-operations