Re:Going Big with TCP Packets
by mprovost on Wednesday February 16, 2022 @12:34PM
(#30362899)
I've played around with jumbo frames in the past. One issue is that none of the checksums at any layer were designed for packets this big. Both the Ethernet and TCP checksums don't have enough bits to reliably detect errors, even on 9k frames. This is ok if you're doing checksumming at the application layer, but often you're not, maybe it's something like NFS that assumes lower levels of the stack take care of message integrity. As transmission speeds have gone up, the bit error rate has stayed the same, so you can just do the math on how many errors you're going to have per day.
[ Parent
| on HN ]
You need to have application-level checksums anyway, since pretty much every router or switch these days will recalculate checksums on all layers (they need to if routing the packet, and since pretty much all COTS chipsets can do L3, they do so all the time even if the switch's software won't let you configure it), so if a bit flips in any router's processing, your checksums won't detect it.
Sure but that means rewriting every application. There was a mind blowing Defcon presentation a few years ago "Bit-squatting: DNS Hijacking Without Exploitation" by Artem Dinaburg where they registered a bunch of domains that were one bit off from well known cloud providers, and recorded all of the requests that leaked out of their internal networks when the DNS response had a bit flipped. That's not to say that you're going to have a huge DNS response, but there is already some amount of this going on at every level of the stack and unless you rewrite every application from DNS on up to check then you're still going to encounter errors.
Well, use TLS and every TCP-using application is already secured.
That's actually a very interesting observation. How much bits should a checksum take for such payloads? At least the 9000 jumbo things.
iSCSI uses a 32 bit CRC. (TCP is 16 bits). There was a draft to use 32 bit TCP checksums but it never got traction: https://datatracker.ietf.org/doc/html/draft-ietf-tcpm-anumit...
SCTP uses a 32 bit checksum.
The NFS WG was adding Integrity Measurement Architecture that would address that and more, but the effort seems to have fizzled out, i assume COVID didn't help. https://datatracker.ietf.org/doc/html/draft-ietf-nfsv4-integ...