2

I'm using netcat to send random data from A to B, both Linux machines on Ethernet networks, with a router in the middle. For pedagogic purposes I'd like to force IP fragmentation on the router (Cisco 1811, base image). I've first lowered the MTU to 500 (instead of the original 1500) on the outbound router interface, but then the router sends and ICMP fragmentation needed message and A lowers TCP segment size accordingly. I've then set a lower MTU directly on B, but then B advertises a lower Maximum Segment Size and A accepts it, leading to no fragmentation.

Can I make A ignore B's MSS in the negociation and use a 1500-tailored segment size anyway? Or do you see another way to force IP fragmentation on the router?

For practical reasons I cannot recompile the kernel or install arbitrary software on the machines, I have to work with what's there (reasonably standard set of networking tools I hope).

6
  • 1
    If you are getting that message, then the df bit is set, and nothing you do will cause fragmentation.
    – Ron Maupin
    Sep 11 '18 at 16:44
  • Right. It is set when I limit the MTU directly on the router (and yet the router fragments, but it is marginal -- I'm bothered by the sender adapting segment size). Can I force this bit to 0 then?
    – Eusebius
    Sep 11 '18 at 16:53
  • Aaargh, it looks like ping -s 1500 -M dont X.X.X.X would be perfect for what I need, but it requires iputils-ping and I don't have it on the machines...
    – Eusebius
    Sep 11 '18 at 17:04
  • It sounds like you are venturing into host/OS territory, which is off-topic here. As far as I can tell, netcat doesn't have an option to not set the df bit. On Cisco devices, you can simply set the size of the ping packets. We do that to test circuits by pinging with very oversized packets for a long time. If all the packet fragments can be reassembled (no fragments are lost), then that is a good sign.
    – Ron Maupin
    Sep 11 '18 at 17:16
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 25 '18 at 9:27
3

I used the following configuration:

  • Standard MTU on A and B;
  • MTU lowered to 500 on the router (B side);
  • /proc/sys/net/ipv4/ip_no_pmtu_disc set to 1 on the sender (A).

And then the sender sticks to 1500 byte segments, and the router fragments.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.