|
|
|
MadEngineer:Nope, I'd omitted the rule. Also works fine with ZeroTier set up.
IPSec disables that. I'm using WireGuard which must do so also.
MichaelNZ:You can't set do not fragment in ipv6 pings.
When using ping command for path MTU discovery be aware of OS variations. Some treat the size variable as the data component only and others as the entire packet (data + header).
When we are talking 1500 MTU this value is including the header.
IPv6 has a fixed header size of 40 bytes so a 1500 MTU would yield a max payload (data) of 1460 bytes. If you are using ping deduct another 8 bytes for ICMPv6 so 1452 bytes.
Also be sure to use the "do not fragment" switch.
MadEngineer:
You can't set do not fragment in ipv6 pings.
The Linux command allows it but its probably extraneous for ICMPv6.
(redacted this after testing)
I don't know the finer details of how the command interacts with the IP system in the kernel so I had been setting it to be sure. But if there is no "do not fragment" option in some other OS (Windows?) then I wouldn't over think it.
WFH Linux Systems and Networks Engineer in the Internet industry | Specialising in Mikrotik | APNIC member | Open to job offers | ZL2NET
MadEngineer:
You can't set do not fragment in ipv6 pings.
IPv6 does allow fragmentation at the source device, but not after that at any router it passes through.
After the post by @MadEngineer I thought I had better test this:
"Will the kernel enforce the ICMPv6 packet size if no-frag option is omitted" and it is clear the answer is no.
For example:
ping -6 -s 1453 -M do [IPv6 capable host]
Response "ping: local error: message too long, mtu: 1500" (This is the expected result)
However....
ping -6 -s 1453 [Same IPv6 capable host]
Response "1461 bytes from redacted (redacted): icmp_seq=1 ttl=61 time=26.2 ms"
So at least under Linux (Ubuntu with 6.14.0 kernel) it needs the no-frag set else the kernel will do what it does and treat ping like any other application and fragment the traffic.
WFH Linux Systems and Networks Engineer in the Internet industry | Specialising in Mikrotik | APNIC member | Open to job offers | ZL2NET
from ping /?
"-f Set Don't Fragment flag in packet (IPv4-only)."
if you try -f -6 you get:
The option -f is only supported for IPv4
well yes and /? instead of -h
|
|
|