[dns-operations] PMTUD of .org servers

[Florian Weimer]

* Paul Vixie:

>> From: Florian Weimer <fw at deneb.enyo.de>
>> Date: Sat, 20 Jun 2009 16:00:01 +0200
>> 
>> I know it's very difficult to build static packet filter rules which
>> handle fragmented traffic properly.  (Stateful packet filters which are
>> part of proprietary network devices are usually not fast enough to cope
>> with heavy DNS or HTTP traffic.)  I can't really fault anyone who tries
>> to make shortcuts.
>
> then they ought to pass all udp fragments to/from their dns servers,
> statelessly.

Yes, except that it sometimes doubles or triples the rule count
(there's the issue of small fragment offsets to worry about).