Hi,

I am seeing a lot of ICMP Must Fragment packets with incorrect ICMP
checksums on a RELENG_4 box which holds up 40-60 PPTP (mpd/Netgraph) VPN
connections at any given time.  The peer understandably ignores the ICMP
packet with a bad checksum and never fragments the offending TCP packet,
effectively killing the connection after a while.

A major point is that I'm only seeing them on the interfaces NAT'ed by
ipnat.  Is anybody else having trouble with ICMP checkums with IPFilter
3.4.35 on a reasonably recent RELENG_4 box?

FreeBSD unnamed 4.10-STABLE FreeBSD 4.10-STABLE #1: Thu Dec 2 10:31:16 EET 2004 
[EMAIL PROTECTED]:/usr/obj/usr/src-bsd/4.0S/src/sys/UNNAMED  i386

drwxr-xr-x  2 root  wheel  512 Dec  2 11:43 /var/db/pkg/mpd-3.18_2

G'luck,
Peter

-- 
Peter Pentchev  [EMAIL PROTECTED]    [EMAIL PROTECTED]    [EMAIL PROTECTED]
PGP key:        http://people.FreeBSD.org/~roam/roam.key.asc
Key fingerprint FDBA FD79 C26F 3C51 C95E  DF9E ED18 B68D 1619 4553
This sentence was in the past tense.

Attachment: pgpjHyrZgiTvt.pgp
Description: PGP signature

Reply via email to