Subject: Re: Usage of packet returned in ICMP error messages

From: Vernon Schryver <[email-masked]>
Date: Tue, 16 Nov 1999 16:13:13 -0700 (MST)

> From: "C. M. Heard/VVNET, Inc." <[email-masked]>

> The IETF MPLS (multi-protocol label switching) working group is currently
> discussing an internet draft <draft-ietf-mpls-icmp-00.txt> which proposes
> some modifications to ICMP error messages that are not entirely backward
> compatible with RFC 1812 (the router requirements document) and RFC 1122
> (the host requirements document).  Specifically, the draft proposes
> that when label-switching routers send an ICMP error message they will
> put a data structure containing the MPLS shim header immediately after
> the first 8 bytes of user data from the original datagram.  As most
> readers of this list are probably aware, RFC 1812 and RFC 1122 permit
> ICMP error message to contain more than 8 bytes of user data from the
> original datagram, but both documents specify that any user data which
> is returned will be copied from the original datagram without change.
> Thus, an application implemented in accordance with those RFCs that
> receives an ICMP error message formatted in accordance with the proposed
> draft could misinterpret the shim header structure as returned user data.
>
> The question arises whether there are, in fact, any applications which
> make use of extra user data (beyond the first 8 bytes) that is returned
> in ICMP error messages.  If the readers of this list are aware of any
> such applications I would appreciate hearing about them.

There are several such applications:

  1. some versions of `ping` and `traceroute` decode the bad packet included
     in the message..

  2. doesn't any TCP host that handles Network or Port Unreachables,
    Quenches, MTU discovery, need to have the orignal IP header follow
    the ICMP gateway address, parameter problem byte MAX MTU, or
    other ICMP data?

  3. how does a host understand a Port Unreachable if the original UDP
     or TCP header is not where it usually is?
     
One might blow off #1 or even #3, but surely not #2.  So I must not
understand the proposal.

Vernon Schryver    [email-masked]