Subject: [dnsext] Fragmentation undesirable

From: "George Barwood" <[email-masked]>
Date: Sat, 15 Aug 2009 08:01:20 +0100

It seems to me that relying on IP fragmentation is undesirable, because it 
places unreasonable demands on low level infrastructure.

To explain: when a computer receieves a message ( IP packet ), we want to be 
able to either process it, or reject it as bogus.

It's undesirable to have to hold onto it until other messages arrive, as 
this will consume resources, which makes the computer vulnerable to denial 
of service (DoS) attacks.

As far as I can see, fragmented IP packets inevitably consume resources, 
because low level infrastructure cannot determine if a fragment is valid or 
bogus.

It's best to have protocols that do not imply a high level of resources to 
stop DoS attacks.

Hence I suggest the IETF / IAB should consider deprecating the use of IP 
fragmentation in protocols when low level validation is not possible. This 
has implications for EDNS @ 4096. Note: in IPv6, the minimum MTU is 1280 
bytes.

George