[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Full-disclosure] Revised paper on "ICMP attacks against TCP"

Florian Weimer wrote:

IIRC, those Cisco products that are not vulnerable to the PMTU just don't implement PMTUD, right? 
You can explicitly enable PMTUD if you want ("ip tcp
path-mtu-discovery").  It's recommended to reduce CPU overhead for
processing BGP message (no kidding, apparently it id make a difference
in the past).


It's still making a difference and not only on Cisco products. When
You have MTU sized down to 576 it's quite harder to push full BGP
table fast. When MTU is 1500, or something around that, you're just
synchronizing faster, because You may pack more information in one
packet.

There's a bunch of presentations freely available that show performance
of BGP sessions with various network-level tweaks.

--
this space was intentionally left blank    |            Łukasz Bromirski
you can insert your favourite quote here   |        lukasz:bromirski,net
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/