Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


View this topic in a long page with up to 500 replies per page Create new topic
1 | 2 
MadEngineer
4623 posts

Uber Geek
+1 received by user: 2605

Trusted

  #3397879 28-Jul-2025 22:40
Send private message

MadEngineer:

 

 IPSec disables that.  I'm using WireGuard which must do so also.

 

Nope, I'd omitted the rule. Also works fine with ZeroTier set up.





You're not on Atlantis anymore, Duncan Idaho.



MadEngineer
4623 posts

Uber Geek
+1 received by user: 2605

Trusted

  #3397881 28-Jul-2025 22:42
Send private message

MichaelNZ:

 

When using ping command for path MTU discovery be aware of OS variations. Some treat the size variable as the data component only and others as the entire packet (data + header).

 

When we are talking 1500 MTU this value is including the header.

 

IPv6 has a fixed header size of 40 bytes so a 1500 MTU would yield a max payload (data) of 1460 bytes. If you are using ping deduct another 8 bytes for ICMPv6 so 1452 bytes.

 

Also be sure to use the "do not fragment" switch.

 

You can't set do not fragment in ipv6 pings.





You're not on Atlantis anymore, Duncan Idaho.

MichaelNZ
1609 posts

Uber Geek
+1 received by user: 490

Trusted
Net Trust Ltd

  #3397884 28-Jul-2025 22:56
Send private message

MadEngineer:

 

You can't set do not fragment in ipv6 pings.

 

 

The Linux command allows it but its probably extraneous for ICMPv6.

 

(redacted this after testing)

 

I don't know the finer details of how the command interacts with the IP system in the kernel so I had been setting it to be sure. But if there is no "do not fragment" option in some other OS (Windows?) then I wouldn't over think it.





WFH Linux Systems and Networks Engineer in the Internet industry | Specialising in Mikrotik | APNIC member | Open to job offers | ZL2NET




fe31nz
1295 posts

Uber Geek
+1 received by user: 423


  #3397886 28-Jul-2025 23:54
Send private message

MadEngineer:

 

You can't set do not fragment in ipv6 pings.

 

 

IPv6 does allow fragmentation at the source device, but not after that at any router it passes through.


MichaelNZ
1609 posts

Uber Geek
+1 received by user: 490

Trusted
Net Trust Ltd

  #3397890 29-Jul-2025 00:34
Send private message

After the post by @MadEngineer I thought I had better test this:

 

"Will the kernel enforce the ICMPv6 packet size if no-frag option is omitted" and it is clear the answer is no.

 

For example:

 

ping -6 -s 1453 -M do [IPv6 capable host]

 

Response "ping: local error: message too long, mtu: 1500" (This is the expected result)

 

However....

 

ping -6 -s 1453 [Same IPv6 capable host]

 

Response "1461 bytes from redacted (redacted): icmp_seq=1 ttl=61 time=26.2 ms"

 

So at least under Linux (Ubuntu with 6.14.0 kernel)  it needs the no-frag set else the kernel will do what it does and treat ping like any other application and fragment the traffic.





WFH Linux Systems and Networks Engineer in the Internet industry | Specialising in Mikrotik | APNIC member | Open to job offers | ZL2NET


MadEngineer
4623 posts

Uber Geek
+1 received by user: 2605

Trusted

  #3398105 29-Jul-2025 20:12
Send private message

from ping /?

 

"-f             Set Don't Fragment flag in packet (IPv4-only)."

 

 

 

if you try -f -6 you get:

 

The option -f is only supported for IPv4





You're not on Atlantis anymore, Duncan Idaho.

 
 
 
 

Shop now for Dyson appliances (affiliate link).
MichaelNZ
1609 posts

Uber Geek
+1 received by user: 490

Trusted
Net Trust Ltd

  #3398106 29-Jul-2025 20:15
Send private message

MadEngineer:

 

from ping /?

 

"-f             Set Don't Fragment flag in packet (IPv4-only)."

 

 

"-f" is the "flood ping" switch. You must be on Windows?





WFH Linux Systems and Networks Engineer in the Internet industry | Specialising in Mikrotik | APNIC member | Open to job offers | ZL2NET


MadEngineer
4623 posts

Uber Geek
+1 received by user: 2605

Trusted

  #3398113 29-Jul-2025 21:21
Send private message

well yes and /? instead of -h





You're not on Atlantis anymore, Duncan Idaho.

1 | 2 
View this topic in a long page with up to 500 replies per page Create new topic








Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.